// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighRCECVSS not assigned

Google Android flaw CVE-2026-58868 could enable remote code execution

Google patched CVE-2026-58868, a critical Android Framework flaw that could enable remote code execution without user interaction on Android 14 through 17.

· 2 min read
AI-generated image of a technician holding a smartphone beside a blurred security workstation.
AI-generated image, not a photo of the event.
Key takeaways
  • Google said its most severe Android bulletin issue could lead to remote code execution without additional privileges or user interaction.
  • Google said CVE-2026-58868 affects Android 14 through 17.
  • Android security patch levels dated 2026-11-05 or later address all November bulletin issues.

Google has published its Android security bulletin and patched a critical Framework vulnerability that could lead to remote code execution without additional privileges or user interaction.

The issue affects Android versions 14 through 17, while phone makers and carriers deliver the fix on their own schedules. Google’s records do not say how an attacker would reach the vulnerable code.

Android 12 and 13 are not listed as affected, but Google’s records do not say whether those versions contain the flaw. As of November 4, Google’s bulletin did not report attacks exploiting its flaws, and CISA’s catalog did not list the issue as of its November 3 update.

On this page

CVE-2026-58868 is a possible heap buffer overflow

Google said the flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp.

The company said its Critical rating assumes Android and Google service protections are turned off or bypassed. Neither the bulletin nor the flaw’s CVE record says how an attacker would reach the vulnerable code.

Android uses two November security patch levels

Google said a 2026-11-01 or later security update covers CVE-2026-58868 and other flaws in the Framework, System and Android runtime components. A 2026-11-01 patch level addresses all issues associated with that patch level.

The company said the two patch levels give Android partners flexibility to fix a subset of vulnerabilities shared across devices more quickly. Phones receive the relevant updates according to phone-maker and carrier schedules.

Google said Android security patch levels dated 2026-11-05 or later address all November bulletin issues. It also said corresponding source-code patches would be released to the Android Open Source Project repository within 48 hours after the bulletin’s initial publication.

Patch levelCoverage
2026-11-01 or laterCovers CVE-2026-58868 and the other flaws in the Framework, System and Android runtime components; addresses all issues associated with that patch level.
2026-11-05 or laterAddresses all November bulletin issues.

What to do now

  1. Update to the latest version of Android where possible.

FAQ

What is CVE-2026-58868?

Google said it is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. The issue could lead to remote code execution without additional privileges or user interaction.

Which Android versions are affected by CVE-2026-58868?

Google said the flaw affects Android 14 through 17. Android 12 and 13 are not listed as affected, but Google’s records do not say whether they contain it.

Has CVE-2026-58868 been exploited?

As of November 4, Google’s bulletin did not report attacks exploiting its flaws. CISA’s Known Exploited Vulnerabilities catalog also did not list the issue as of its November 3 update.

How do I fix CVE-2026-58868 on Android?

Google said Android security patch levels dated 2026-11-05 or later address all November bulletin issues. It also said a 2026-11-01 or later security patch level covers CVE-2026-58868, subject to phone-maker and carrier schedules.

Sources

  1. Android Security Bulletin, November 2026 | Android Open Source Project, GooglePrimary
  2. Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction, The Hacker News
How we checked this story
ClaimSourceStatus
Google said the most severe Android bulletin issue could lead to remote code execution without additional privileges or user interaction.GoogleConfirmed
Google said Android security patch levels dated 2026-11-05 or later address all November bulletin issues.GoogleConfirmed
Neither Google’s bulletin nor the CVE record says how an attacker would reach the vulnerable code.Google, via The Hacker NewsAttributed
As of November 4, Google’s bulletin did not report attacks exploiting its flaws.Google, via The Hacker NewsAttributed
The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog as of its November 3 update.CISA, via The Hacker NewsAttributed
Android 12 and 13 are not listed as affected, but Google’s records do not say whether they contain the flaw.Google, via The Hacker NewsAttributed
Google said partners receive notice of all Android issues at least one month before bulletin publication.GoogleConfirmed
Google said corresponding source-code patches would be released to AOSP within 48 hours after the bulletin’s initial publication.GoogleConfirmed
Google said Android security patch levels dated 2026-11-01 or later address all issues associated with that patch level.GoogleConfirmed
Google said Android partners may fix a subset of vulnerabilities sooner using the two patch levels.GoogleConfirmed
Google encourages Android partners to fix all issues in the bulletin and use the latest security patch level.GoogleConfirmed

Could not verify

  • Whether CVE-2026-58868 was exploited in the wild is not established.
  • How many devices are affected is not established.
  • How an attacker would reach the vulnerable code is not established.
  • Whether Android 12 and 13 contain the flaw is not established.
cvegoogle
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok