Google Patches Critical Android Flaw That Could Enable Remote Code Execution Without User Interaction
Summary
Google's November Android bulletin includes CVE-2026-58868, a critical flaw affecting Android 14–17. Patch level 2026-11-01 or later addresses it; Google reported no known exploitation as of November 4.
Key points
- CVE-2026-58868 is described as a possible heap-buffer-overflow out-of-bounds write in FrameDecoder.cpp's onOutputReceived function; the bulletin does not explain how an attacker would reach the code.
- The flaw affects Android 14 through 17. Patch level 2026-11-01 or later covers it; Google lists no workaround for devices that cannot yet install the update.
- Google's bulletin reported no exploitation of its listed flaws, and CVE-2026-58868 was not in CISA's Known Exploited Vulnerabilities catalog as of November 3.
- The bulletin lists 216 vulnerabilities, including 23 rated Critical; patch level 2026-11-05 or later covers all flaws in the bulletin.
- CVE-2026-58882 could enable remote denial of service through Android's WAP Push handling. A researcher reported that a malformed message can crash the phone, but Google and the CVE record do not establish whether it is the same bug as the researcher's write-up.
- The bulletin also lists Critical remote code execution flaws CVE-2026-58876 and CVE-2026-58936 in Android's System component.
Article Details
- Event Type
- Google security bulletin and patch release for critical Android vulnerabilities
- Impact
- CVE-2026-58868 could allow remote code execution without user interaction on Android 14 through 17; the article says the bulletin did not report attacks exploiting its flaws as of November 4. CVE-2026-58882 could cause remote denial of service without user interaction: a malformed WAP Push message can crash com.android.phone, end active calls including emergency calls, and trigger repeated crashes on startup. The article reports that Android security patch level 2026-11-01 or later covers CVE-2026-58868, while 2026-11-05 or later covers every flaw in the bulletin. It gives no workaround for phones that cannot yet install the update.
CVE
CVE-2026-58868Google · AndroidThe flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.CVE-2026-58876Google · AndroidPhones running Android 10 or later may also receive some fixes through Google Play system updates. This month's list for those updates includes another Critical flaw, CVE-2026-58876.CVE-2026-58882Vendor / Product unavailableAnother Critical flaw, CVE-2026-58882, could allow a remote denial-of-service attack with no user interaction, according to its CVE record. It is in decodeWapPdu, a function in Android's code for WAP Push messages thatCVE-2026-58936Google · AndroidGoogle's November bulletin lists 216 vulnerabilities, 23 of them rated Critical. Two more Critical flaws could allow remote code execution: CVE-2026-58876 and CVE-2026-58936, both in Android's System component.
People
Vendors
GoogleA critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin.MediaTekA date of 2026-11-05 or later covers every flaw in the November bulletin, including those in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.QualcommA date of 2026-11-05 or later covers every flaw in the November bulletin, including those in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.