A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin.
The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.
As of November 4, Google's bulletin did not report any attacks exploiting its flaws. None of them was in the Known Exploited Vulnerabilities catalog, kept by the U.S. Cybersecurity and Infrastructure Security Agency, as of its November 3 update.
The flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of the file FrameDecoder.cpp. Neither the bulletin nor the flaw's CVE record says how an attacker would reach that code.
Google's Critical rating assumes that the protections built into Android and Google's services are turned off or bypassed.
Older versions, such as Android 12 and 13, are not listed as affected by the flaw. Google's records do not say whether they contain it.
The Android security update date is the phone's security patch level. A date of 2026-11-01 or later covers CVE-2026-58868 and the other flaws in the Framework, System, and Android runtime components.
A date of 2026-11-05 or later covers every flaw in the November bulletin, including those in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Google sets two dates so phone makers can ship a set of fixes common to all Android devices sooner.
Source link
