Google fixes critical Android remote code execution vulnerability

Google has released fixes for CVE-2026-58868, a Critical Android vulnerability that could allow remote code execution without user interaction. The issue affects Android 14 through Android 17 and is addressed by the Android security patch level dated 2026-11-01 or later.

As of 4 November, Google had not reported attacks exploiting the flaws in its November Android Security Bulletin. The vulnerabilities were also absent from the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog in its 3 November update.

What the Android flaw affects

CVE-2026-58868 is an out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function in FrameDecoder.cpp. Neither Google’s bulletin nor the CVE record identifies the route an attacker would use to reach the vulnerable code.

Google’s Critical rating assumes Android and Google service protections have been disabled or bypassed. Android 12 and Android 13 are not listed as affected by this CVE, although Google’s records do not state whether the issue exists in those releases.

The 2026-11-01 patch level covers CVE-2026-58868 and other Framework, System and Android Runtime issues. The broader 2026-11-05 patch level addresses every vulnerability in the November bulletin, including kernel fixes and fixes affecting components from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.

A larger November patch set

Google lists 216 vulnerabilities in the November bulletin, with 23 rated Critical. Two additional Critical System-component vulnerabilities, CVE-2026-58876 and CVE-2026-58936, could permit remote code execution. Six Critical vulnerabilities are in the kernel, including two in Bluetooth code.

One further Critical issue, CVE-2026-58882, concerns Android’s handling of WAP Push messages delivered through SMS. Its CVE record says a remote denial-of-service attack may be possible without user interaction. A public write-up described malformed WAP Push messages crashing com.android.phone, ending active calls and potentially recurring after restart while the message remains queued.

This pattern of high-volume platform remediation follows Google’s large Chrome vulnerability patch release and highlights why security teams need an inventory that records both Android version and patch level, rather than treating operating-system version as proof of current protection.

What organisations should check

Users can find the relevant date in Settings under About phone or About tablet, then Android version. The Android security update date—not the Google Play system update date—is the control point for CVE-2026-58868. Although Android 10 and later may receive some fixes through Google Play system updates, this specific CVE is not included in that month’s Play update list.

Device manufacturers and carriers distribute updates on their own schedules, and Google provides no workaround for phones that cannot yet install the update. Organisations should identify managed Android 14–17 devices below the 2026-11-01 level, pursue the 2026-11-05 level where available, and track exceptions until vendors deliver the required patch.