A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin.
The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.
As of November 4, Google’s bulletin did not report any attacks exploiting its flaws. None of them was in the Known Exploited Vulnerabilities catalog, kept by the U.S. Cybersecurity and Infrastructure Security Agency, as of its November 3 update.
The flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of the file FrameDecoder.cpp. Neither the bulletin nor the flaw’s CVE record says how an attacker would reach that code.
Google’s Critical rating assumes that the protections built into Android and Google’s services are turned off or bypassed.
Older versions, such as Android 12 and 13, are not listed as affected by the flaw. Google’s records do not say whether they contain it.
How to Check Your Phone
Google’s help page gives these steps:
- Open the Settings app.
- Tap About phone, or About tablet, then Android version.
- Find the dates for the Android security update and the Google Play system update.
The Android security update date is the phone’s security patch level. A date of 2026-11-01 or later covers CVE-2026-58868 and the other flaws in the Framework, System, and Android runtime components.
A date of 2026-11-05 or later covers every flaw in the November bulletin, including those in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Google sets two dates so phone makers can ship a set of fixes common to all Android devices sooner. It encourages them to include every fix in the bulletin.
Phones running Android 10 or later may also receive some fixes through Google Play system updates. This month’s list for those updates includes another Critical flaw, CVE-2026-58876.
CVE-2026-58868 is not on that list, so the date to check for it is the Android security update.
The bulletin gives no workaround for phones that cannot install the update yet.
A Remote Denial-of-Service Flaw in Android’s Text-Message Code
Another Critical flaw, CVE-2026-58882, could allow a remote denial-of-service attack with no user interaction, according to its CVE record. It is in decodeWapPdu, a function in Android’s code for WAP Push messages that arrive via SMS.
On October 29, a researcher who publishes as Mark B posted a write-up called “SMS of Death” about a bug in the same function. Neither the bulletin nor the CVE record says whether CVE-2026-58882 is that bug.
One malformed WAP Push message crashes com.android.phone and ends any active call, including emergency calls, according to the write-up. In tests on several phone models, the crash happened every time.
The attacker needs only the target’s phone number, and the message never shows up in the inbox. The phone retries the message each time it starts, so it can crash on startup until the message is removed.
A proof-of-concept app that sends such a message from one phone to another is public. Phones running Android 12 and 13 run the same code but do not receive the fix that newer versions do, the researcher says.
Other Critical Flaws
Google’s November bulletin lists 216 vulnerabilities, 23 of them rated Critical. Two more Critical flaws could allow remote code execution: CVE-2026-58876 and CVE-2026-58936, both in Android’s System component.
Six Critical flaws are in the kernel, two of them in Bluetooth code. The most severe kernel flaw could allow a remote attacker to gain elevated privileges without user interaction.
The 2026-11-05 patch level also fixes Critical flaws in MediaTek modem code and in a closed-source Qualcomm component. In its November bulletin, MediaTek describes its Critical modem flaws as out-of-bounds writes and says it is not aware of any active exploitation.
