Overview
Google's November 2026 Android Security Bulletin, published 2 November, fixes 216 CVEs, of which 23 are rated Critical and 193 High. The headline issue is CVE-2026-58868, a critical remote code execution flaw in the Android Framework that requires no user interaction.
CVE-2026-58868
| Attribute | Value |
|---|---|
| Component | Framework |
| Type | Remote code execution |
| Root cause | Out-of-bounds write (heap buffer overflow) in onOutputReceived in FrameDecoder.cpp |
| Affected | Android 14, 15, 16, 16-qpr2, and 17 |
| Bulletin reference | A-486464711 |
| User interaction | None |
| Privileges needed | None |
Google says the bulletin does not report any of the issues as exploited in the wild. As of 4 November, NVD listed the CVE as awaiting analysis, with no CVSS score.
Two other critical RCEs, CVE-2026-58876 and CVE-2026-58936, are in the System component.
Patching Notes
- The bulletin ships fixes in two patch levels, 2026-11-01 and 2026-11-05. Patch level 2026-11-05 or later addresses all issues in the bulletin. CVE-2026-58868 is in the 2026-11-01 section. Press coverage differs on which level to cite, so aim for 2026-11-05.
- CVE-2026-58868 is not covered by Google Play system updates, so devices depend on manufacturer firmware updates. Availability will vary by vendor and carrier.
Recommendations
- Check Settings → About phone → Android version → Security patch level and install updates as soon as your device maker ships them.
- For managed fleets, push the November update through MDM and report on devices still below 2026-11-05.
- Retire devices that no longer receive security updates, especially on Android 14 or later with lapsed vendor support.
- Restrict untrusted media and sideloaded apps on unpatched devices until the update is installed.