Google Patches Critical Android Flaw That Could Allow Remote Code Execution Without User Action

A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.

Google's November Android bulletin, published November 2, covers two patch levels. Level 2026-11-01 carries the Android runtime, Framework and System fixes; 2026-11-05 adds kernel and chip-vendor fixes from Arm, Imagination, MediaTek, Unisoc and Qualcomm. Google says devices on 2026-11-05 or later are protected against everything listed. The bulletin lists 216 vulnerabilities, 23 of them rated Critical.

The flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of the file FrameDecoder.cpp. Neither the bulletin nor the flaw's CVE record says how an attacker would reach that code. Google's Critical rating assumes that the protections built into Android and Google's services are turned off or bypassed.

Two more critical remote code execution bugs sit in System: CVE-2026-58876, a use-after-free, and CVE-2026-58936. The November 5 patch level also addresses critical vulnerabilities in MediaTek modem code and a closed-source Qualcomm component. Older versions, such as Android 12 and 13, are not listed as affected by CVE-2026-58868.

As of November 4, Google's bulletin did not report any attacks exploiting its flaws. None of them was in the Known Exploited Vulnerabilities catalog, kept by the U.S. Cybersecurity and Infrastructure Security Agency, as of its November 3 update. Google said it will publish source patches to the Android Open Source Project within 48 hours of the bulletin.

Users can check their phone by looking at the Android security update date in Settings. A date of 2026-11-01 or later covers CVE-2026-58868 and the other flaws in the Framework, System and Android runtime components, while a date of 2026-11-05 or later covers every flaw in the November bulletin.