Android November 2026 update fixes critical zero-click RCE CVE-2026-58868 in Framework

What happened

Google’s November 2026 Android security bulletin patches 216 vulnerabilities, 23 of them rated Critical, according to The Hacker News and Security Affairs. SecurityWeek reports “more than 200” fixes, including two dozen critical issues. GBHackers says the bulletin was published on November 2.

The headline flaw. CVE-2026-58868 is in the Framework component. Google says it “could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation” (SecurityWeek). It is an out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp, and it affects Android 14 through 17 (The Hacker News). Neither the bulletin nor the CVE record says how an attacker would reach the vulnerable code (The Hacker News, GBHackers). Google’s Critical rating assumes Android’s built-in protections and Google’s services are turned off or bypassed (The Hacker News).

Other critical issues

• CVE-2026-58876 and CVE-2026-58936 are two further critical RCE flaws in the System component (The Hacker News, GBHackers).
• Six critical flaws are in the kernel, including Bluetooth code. The most severe could let a remote attacker gain elevated privileges without user interaction (The Hacker News).
• Critical flaws are also fixed in MediaTek modem code and in a closed-source Qualcomm component tracked as CVE-2026-25285. Google gives no further technical detail on the Qualcomm issue (Security Affairs). MediaTek says it is not aware of active exploitation of its modem flaws (The Hacker News).

CVE-2026-58882 and the SMS of Death write-up. This Critical flaw could allow a remote denial-of-service attack with no user interaction. It is in decodeWapPdu, the code that handles WAP Push messages delivered by SMS (The Hacker News). On October 29 a researcher known as Mark B published a write-up about a bug in the same function. It says one malformed message crashes com.android.phone, ends active calls including emergency calls, never appears in the inbox, and can cause a crash loop at startup until the message is removed. It also says a public proof-of-concept app exists (The Hacker News, Security Affairs). Neither the bulletin nor the CVE record confirms that CVE-2026-58882 is the same bug, so treat that link as not confirmed (Security Affairs).

Exploitation status. As of November 4, Google’s bulletin reported no attacks, and none of the flaws was in CISA’s Known Exploited Vulnerabilities catalog as of its November 3 update (The Hacker News, The 420.in). One sentence in Security Affairs says Google “is now aware of active exploitation,” which contradicts those reports and is not supported by the other sources. Treat active exploitation as not confirmed.

Am I affected?

• Android 14 through 17 (including 16-QPR2) without the November update. Yes, for CVE-2026-58868. The same releases are listed for CVE-2026-58876, CVE-2026-58936 and CVE-2026-58882 (GBHackers).
• Android 12 and 13. These are not listed as affected by CVE-2026-58868, but Google’s records do not say whether they contain the flaw, so this is not confirmed (The Hacker News). The researcher says these versions run the decodeWapPdu code but do not receive the fix that newer versions do (The Hacker News).
• Devices no longer getting manufacturer updates. These may stay exposed to flaws that Google Play system updates cannot correct (The 420.in).
• Android Wear OS and Android XR. Google also published bulletins for both. The XR update fixes one high-severity Framework flaw and the Wear OS patch fixes two high-severity issues in Framework and System (SecurityWeek).

To check a device, open Settings, tap About phone (or About tablet), then Android version, and read the Android security update date and the Google Play system update date (The Hacker News).

What to do now

1. Install the November 2026 Android update as soon as your phone maker or carrier offers it. Timing varies by manufacturer and carrier (The 420.in).
2. Verify the security patch level, not just the Android version (GBHackers). A level of 2026-11-01 or later covers CVE-2026-58868 and the other Framework, System and Android runtime fixes. A level of 2026-11-05 or later covers every flaw in the bulletin, including kernel and chipset fixes from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm (The Hacker News).
3. Check the Android security update date for CVE-2026-58868. Google Play system updates (Android 10 or later) carry some fixes, including CVE-2026-58876, but CVE-2026-58868 is not on that list (The Hacker News).
4. For managed fleets, validate remediation per device against the two patch levels, because the 2026-11-05 level incorporates earlier requirements (GBHackers).
5. For phones that cannot yet install the update, note that the bulletin gives no workaround (The Hacker News). Any mitigation for the WAP Push crash is not confirmed in the sources.
6. Recheck Google’s bulletin and CISA’s KEV catalog for changes to exploitation status, since the sources conflict slightly on that point.

Sources

• SecurityWeek, Android’s November 2026 Updates Patch Over 200 Vulnerabilities
• The Hacker News, Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
• Security Affairs, CVE-2026-58868: Critical Android Bug Could Let Attackers Run Remote Code
• GBHackers, Google Patches Critical Android RCE Flaws That Let Attackers Execute Code Without User Interaction
• The 420.in, Google Patches Critical Android Remote Code Execution Flaw