Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Google has issued patches for a critical Android vulnerability that could allow remote code execution without user interaction.
A critical Android flaw, CVE-2026-58868, could allow attackers to run code on phones remotely without any user action, according to Google's November security bulletin. The vulnerability affects Android 14 through 17, with fixes included in security patch level 2026-11-01 or later. Phone manufacturers and carriers will distribute these updates on their own schedules.
As of November 4, Google reported no active exploits of this or other flaws in its bulletin. None were listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of its November 3 update. The flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp.
Checking Your Phone
To check if your device is protected, open Settings, tap About phone/tablet, then Android version. Look at the Android security update date - a date of 2026-11-01 or later covers CVE-2026-58868. For all flaws including kernel and vendor components, you need the 2026-11-05 patch level. Google encourages manufacturers to include all fixes but allows them to ship common updates earlier.
SMS Vulnerability
Another critical flaw, CVE-2026-58882, could enable remote denial-of-service attacks via SMS. It affects the decodeWapPdu function in Android's WAP Push message handling. A researcher known as Mark B detailed a similar bug in an October 29 post called 'SMS of Death,' where a malformed WAP Push message crashes the com.android.phone process, ending active calls including emergency ones.
The attacker needs only the target's phone number, and the message never shows up in the inbox. The phone retries the message each time it starts, so it can crash on startup until the message is removed.
Other Critical Issues
Google's November bulletin lists 216 vulnerabilities total, with 23 rated Critical. Two additional Critical flaws (CVE-2026-58876 and CVE-2026-58936) could allow remote code execution in Android's System component. Six Critical flaws affect the kernel, including two in Bluetooth code that could enable privilege escalation. The 2026-11-05 patch also fixes Critical flaws in MediaTek modem code and a Qualcomm component.
Related
