Google patches an Android flaw that can run code without user action
A critical Android flaw could let an attacker run code on a phone remotely without any user action, according to Google’s November security bulletin. The flaw is CVE-2026-58868, and Google says it affects Android 14 through 17. Security patch level 2026-11-01 or later includes the fix for CVE-2026-58868. Phone makers and carriers deliver that update on their own schedules, and Google says older versions such as Android 12 and 13…