Google’s November 2026 Android security bulletin fixes CVE-2026-58868, a critical flaw that could let an attacker run code on a phone remotely without the owner doing anything. Google’s bulletin lists it as a remote code execution bug affecting Android 14, 15, 16 and 17. According to The Hacker News, it is a heap buffer overflow in FrameDecoder.cpp, and neither the bulletin nor the CVE record says how an attacker would reach that code. Google’s bulletin did not report any attacks using this month’s flaws, and The Hacker News says none was in CISA’s Known Exploited Vulnerabilities catalog as of its November 3 update.
The bulletin is large: The Hacker News counts 216 vulnerabilities, 23 of them rated Critical, including more remote code execution flaws in the System component (CVE-2026-58876 and CVE-2026-58936) and six critical kernel flaws. One more critical flaw, CVE-2026-58882, is a remote denial-of-service bug in the code that handles WAP Push text messages. On October 29 a researcher known as Mark B published “SMS of Death”, describing a single malformed WAP Push message that crashes the phone process, ends any active call (emergency calls included) and needs only the target’s phone number. Neither the bulletin nor the CVE record says whether CVE-2026-58882 is that bug, per The Hacker News. The researcher’s page says Google’s October fix covered Android 14 through 17, and that Android 12 and 13 run the same code but do not get it.
How to check if you’re affected
Affected devices are phones and tablets running Android 14 through 17; The Hacker News notes older releases such as Android 12 and 13 are not listed as affected by CVE-2026-58868 and that Google’s records do not say whether they contain it. To see where your device stands, as The Hacker News relays from Google’s help page:
- Open Settings, tap About phone (or About tablet), then Android version.
- Find the “Android security update” date, which is your security patch level.
- A patch level of 2026-11-01 or later covers CVE-2026-58868 and the other Framework, System and Android runtime flaws. A level of 2026-11-05 or later covers every flaw in the bulletin, including the kernel and chipmaker (Arm, Imagination Technologies, MediaTek, Unisoc, Qualcomm) fixes.
- Phones on Android 10 or later may also get some fixes through Google Play system updates, which is where CVE-2026-58876 is fixed. CVE-2026-58868 is not on that list, so for it the date to check is the Android security update.
Phone makers and carriers release the update on their own schedules, and the bulletin offers no workaround for phones that cannot install it yet. If your device shows an older patch level, check for system updates and install what is offered.
Sources
- Android Open Source Project: Android Security Bulletin, November 2026
- Google: Check and update your Android version
- MediaTek: Product Security Bulletin, November 2026
- SMS of Death: zero-click Android telephony DoS (researcher write-up)
- The Hacker News: Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction