Android Zero-Click Flaw CVE-2026-58868 Fixed in November Patch

What Google fixed

Google's November 2026 Android Security Bulletin came out on November 2. Its most serious entry is a remote code execution bug in the Android Framework that needs no action from the phone's owner.106 The flaw is tracked as CVE-2026-58868. Google says an attacker could use it to run code without any extra execution privileges and without the user doing anything.4 It affects Android 14, 15, 16, 16 QPR2 and 17, which covers every Android release that still gets security support.62

The technical details are thin but consistent across reports. The CVE record describes a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp.11 That file belongs to the media-handling code that makes preview images such as photo and video thumbnails.2 This matters because routine processing of received or downloaded media could, in principle, reach that code without anyone opening a file.2 However, neither the bulletin nor the CVE record says how an attacker would actually reach the vulnerable code.115

The framework bug is the headline, but the bulletin is large. Most outlets count 216 vulnerabilities, with 23 rated Critical and 193 rated High.8 Two more Critical flaws in the System component, CVE-2026-58876 and CVE-2026-58936, could also allow remote code execution without user interaction.9 One public description calls CVE-2026-58936 a use-after-free in the PNG-handling routine png_set_tRNS. CVE-2026-58876 is a use-after-free in Media Codecs.1014 Taken together, the three zero-click RCE bugs all sit in code that parses media or images, which is where an attacker controls the incoming content.

The "SMS of Death" and the rest of the bulletin

One of the most concrete threats in this bulletin is a denial-of-service bug, not a code-execution bug. CVE-2026-58882 sits in decodeWapPdu, the function that handles WAP Push messages delivered by SMS. An attacker needs only the target's phone number, and the malicious message never shows up in the inbox.11 Coverage says the bug can crash Android's phone service and drop active calls, including emergency calls. Because the phone reprocesses the message after each restart, it can also get stuck in a reboot loop.211

The reporting is less settled on where this bug came from. Some outlets tie it to research by an independent researcher, named as Mark B or Mark Blaszczyk, who reportedly reproduced the problem on Pixel 9 and Samsung Galaxy devices.75 One report notes that Google's bulletin does not say whether CVE-2026-58882 is the same bug that researcher described.5 That is a fair caution, but the descriptions line up closely enough that a link seems likely, even though it is unconfirmed.

Beyond the platform code, the kernel section has six Critical entries. They include two Bluetooth bugs, and the most severe kernel issue could let a remote attacker gain elevated privileges without user interaction.118 Chipset suppliers also feature heavily. Critical fixes cover MediaTek modem code and a closed-source Qualcomm component, and MediaTek says it knows of no active exploitation of its modem flaws.119 Samsung shipped its own November update alongside Google's fixes, adding Galaxy-specific patches such as a bootloader bug that requires physical access.

No breach, no known exploitation

This story is about a disclosed vulnerability, not a data breach. Reports agree that Google has not flagged any of the 216 flaws as exploited. Google normally marks actively attacked bugs as under "limited, targeted exploitation," and this bulletin contains no such note.14 As of CISA's November 3 catalog update, none of the CVEs appeared in its Known Exploited Vulnerabilities list.115 No public proof-of-concept exploit has been confirmed either.214

The consumer-facing headlines say users "can be hacked without noticing anything." Technically, that describes what a zero-click RCE could do, but it skips an important qualifier. Google's Critical ratings assume that Android's built-in platform and service protections are switched off or have already been bypassed.116 One analysis therefore concludes that a Critical label describes potential impact under those conditions. It does not mean every unpatched phone can be attacked right now through an internet-facing service.6 Cybernews, whose coverage leans most heavily on the alarm, also concedes that zero-click does not mean attackers can reach every device over the internet.2

The sober reading still gives no reason to wait. CISA's SSVC entries for the three Critical RCE bugs reportedly record exploitation as "none," but list them as automatable with "total" technical impact. Automatable bugs with total impact are the kind attackers turn into scalable exploits once patches show what changed. Google says it will publish source patches to the Android Open Source Project within 48 hours of the bulletin.6 Those public diffs shorten the time defenders have before attackers can work out what was fixed. Another report points to a related trend: attackers using n-day exploits, meaning bugs that are already known and patched, in zero-click attacks on iOS and Android, with unpatched phones as the targets.3

Where the coverage disagrees

The biggest disagreement is over scoring. Cybernews says CVE-2026-58876 and CVE-2026-58936 are both rated 9.8 out of 10.2 Other trackers that checked the NVD records on November 4 found all three Critical RCE entries still marked "Awaiting Analysis," with no CVSS score from either NVD or Google.14 Google's bulletin uses its own Critical/High/Moderate scale rather than CVSS. The 9.8 figure may be an informal estimate, but it was not an official score when the bulletin was published.

The vulnerability count also varies. Most outlets report 216 CVEs, but one roundup citing CyberStack gives 208, still with 23 Critical.10 SecurityWeek and heise avoid an exact number and say "more than 200."49 The 23 Critical figure is the most consistent number across all coverage.

The status of Android 12 and 13 is the most important point of disagreement for users. The bulletin does not list those versions as affected by CVE-2026-58868, and Google's records do not say whether they contain the bug.11 Lifehacker reads that gap hopefully and suggests older phones may be unaffected.1 Cybernews reads it the other way: the vulnerable file carries a 2017 copyright header, so end-of-life releases could be exposed too.2 The Cybernews view seems more defensible. Android 12 and 13 no longer get platform patches, so leaving them off the bulletin is not evidence that they are safe.

The patch gap is the real story

The most important figure in this cycle is not a CVE score. Citing Android's distribution data, Cybernews reports that 43.6% of active devices still run Android 13 or older and no longer receive security fixes.2 Even supported phones must wait for each manufacturer, and sometimes each carrier, to build and ship the update on their own schedule.111 Budget handsets that have passed their promised update window may never get the November patch.2

The update process itself is easy to misread. Google publishes two patch levels. The 2026-11-01 level covers the Framework, System and runtime fixes, including CVE-2026-58868. The 2026-11-05 level adds the kernel and chipset fixes and is the only one that covers the whole bulletin.11 Some fixes, including CVE-2026-58876, can arrive earlier through Google Play system updates on Android 10 and later. CVE-2026-58868 is not delivered that way, so the security patch date on the device is the only reliable check.510 Google offers no workaround for phones that cannot install the update yet.11

What to do

Users should look up their phone's security patch level in Settings. The exact menu varies by device, but outlets point to the About phone or Security sections.13 A date of 2026-11-01 or later fixes the framework flaw, and 2026-11-05 covers everything in the bulletin.8 Companies managing phone fleets are advised to pull patch-level reports from their device-management tools, flag any handset below 2026-11-05, and check Google Play system update status as well.10

The bottom line: November's bulletin is not an emergency in the sense of active attacks. The real problem is a familiar one. Google has disclosed zero-click, remotely reachable memory-corruption bugs in media code, and nearly half of active Android devices will never get the fix. For those phones, the risk does not go away once the patch ships, because publishing the fix makes the bugs easier for attackers to find.