Google Patches Critical Android Flaw That Could Enable Remote Code Execution

Google’s November Android security bulletin includes a patch for CVE-2026-58868, a critical vulnerability that could allow remote code execution without any action from the phone’s owner. The flaw affects Android 14 through 17, and the fix is included in security patch level 2026-11-01 or later. Device makers and carriers distribute updates on their own schedules.

The vulnerability involves a heap buffer overflow that could cause an out-of-bounds write in the onOutputReceived function in FrameDecoder.cpp. Google’s bulletin and the CVE record do not explain how an attacker could reach the affected code. Google’s Critical rating assumes Android and Google’s built-in protections are disabled or bypassed.

As of November 4, Google had not reported attacks exploiting the flaws in its bulletin. CVE-2026-58868 was also absent from the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog as of its November 3 update. Android 12 and 13 are not listed as affected, though Google’s records do not say whether those versions contain the flaw.

To check a phone’s patch level, open Settings, tap About phone or About tablet, then Android version, and look for the Android security update date. A date of 2026-11-01 or later covers CVE-2026-58868 and other listed flaws in Android’s Framework, System and runtime components. The 2026-11-05 level covers all vulnerabilities in the bulletin, including those affecting the kernel and components from chip and technology vendors.

Google’s bulletin also lists CVE-2026-58882, a separate critical flaw that could cause a remote denial of service without user interaction. Its CVE record places the issue in decodeWapPdu, a function used to process WAP Push messages delivered by SMS. A researcher’s October 29 write-up described a bug in the same function, but neither Google nor the CVE record confirms whether it is the same vulnerability.

The bulletin contains 216 vulnerabilities, 23 rated Critical. Two other Critical flaws that could allow remote code execution, CVE-2026-58876 and CVE-2026-58936, are in Android’s System component. The 2026-11-05 patch level also addresses Critical issues in the kernel and in MediaTek modem code and a closed-source Qualcomm component. Google’s bulletin does not provide a workaround for phones that have not yet received the update.

Sources: The Hacker News.