A critical Android flaw could let an attacker run code on a phone remotely without any user action, according to Google’s November security bulletin. The flaw is CVE-2026-58868, and Google says it affects Android 14 through 17.
Security patch level 2026-11-01 or later includes the fix for CVE-2026-58868. Phone makers and carriers deliver that update on their own schedules, and Google says older versions such as Android 12 and 13 are not listed as affected even though its records do not say whether they contain the flaw.
How Google frames the flaw
Google’s Critical rating assumes that Android’s built-in protections and Google’s services are turned off or bypassed. The bulletin says the flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. It does not say how an attacker would reach that code, and neither the bulletin nor the CVE record gives a route to it.
As of November 4, Google had not reported any attacks that exploited the flaws in the bulletin. None of them was in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency as of its November 3 update.
Checking whether a phone has the fix
Google’s help page says to open the Settings app, tap About phone or About tablet, then Android version, and look for the Android security update date and the Google Play system update date. The Android security update date is the phone’s security patch level.
A date of 2026-11-01 or later covers CVE-2026-58868 and the other flaws in the Framework, System, and Android runtime components. A date of 2026-11-05 or later covers every flaw in the November bulletin, including flaws in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm. Google uses two dates so phone makers can ship a shared set of fixes sooner, and it encourages them to include every fix in the bulletin.
Phones running Android 10 or later may also receive some fixes through Google Play system updates. This month’s list for those updates includes another Critical flaw, CVE-2026-58876, but CVE-2026-58868 is not on that list, so the Android security update is the date to check for it. The bulletin gives no workaround for phones that cannot install the update yet.
A second Critical Android flaw in SMS handling
Google also lists another Critical flaw, CVE-2026-58882, that could allow a remote denial-of-service attack with no user interaction, according to its CVE record. It sits in decodeWapPdu, a function in Android’s code for WAP Push messages delivered through SMS. On October 29, researcher Mark B published a write-up called “SMS of Death” about a bug in the same function, but neither the bulletin nor the CVE record says whether CVE-2026-58882 is that bug.
The write-up says one malformed WAP Push message crashes com.android.phone and ends any active call, including emergency calls. In tests on several phone models, the crash happened every time. The attacker needs only the target’s phone number, and the message never appears in the inbox. The phone retries the message each time it starts, so it can keep crashing on startup until the message is removed. A proof-of-concept app that sends such a message from one phone to another is public, and the researcher says phones running Android 12 and 13 use the same code but do not get the fix that newer versions do.
Other critical flaws in the November bulletin
Google’s November bulletin lists 216 vulnerabilities, 23 of them rated Critical. Two more Critical flaws, CVE-2026-58876 and CVE-2026-58936, could allow remote code execution, and both are in Android’s System component. Six Critical flaws are in the kernel, including two in Bluetooth code. Google says the most severe kernel flaw could let a remote attacker gain elevated privileges without user interaction.
The 2026-11-05 patch level also fixes Critical flaws in MediaTek modem code and in a closed-source Qualcomm component. In its November bulletin, MediaTek describes its Critical modem flaws as out-of-bounds writes and says it is not aware of any active exploitation.
Licensed under CC BY-ND 4.0 International