Google patches Android flaw enabling remote code execution

Google has released patches for a critical Android vulnerability that could allow remote code execution without user interaction. The flaw, CVE-2026-58868, affects Android versions 14 through 17 and is addressed in patches issued with security update level 2026-11-01 or later. Google notes the vulnerability stems from an out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of the FrameDecoder.cpp file.

The company’s November 2026 security bulletin does not detail a specific attack vector, and there is no indication as of 3 November 2026 that any exploit has been observed in the wild, nor is CVE-2026-58868 listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog at that time. CVE-2026-58876 and CVE-2026-58936 are noted as additional Critical flaws in the same bulletin, affecting the System component.

The bulletin also highlights CVE-2026-58882, another Critical flaw that could enable a remote denial-of-service attack via SMS WAP Push messages, with evidence suggesting a malformed message could crash the com.android.phone and terminate active calls on several devices. A proof-of-concept exists, and differences in impact across Android versions are noted: devices running Android 12 and 13 may not receive the fix.

Google provides guidance on checking a device’s patch status via the Android version and update dates, emphasising 2026-11-01 or later for CVE-2026-58868 and related Framework, System and Android Runtime fixes, while 2026-11-05 or later covers the full November bulletin across kernel and vendor components.