Android CVE-2026-58868: Critical No-Click Flaw Fixed in November Security Patch

Google's November Android update fixes CVE-2026-58868, a critical remote code execution flaw in the Framework that an attacker can trigger without the phone's owner doing anything. The bulletin lists it as critical, affecting Android 14, 15, 16, 16-qpr2 and 17, and states that "user interaction is not needed for exploitation". Google's bulletin doesn't say the flaw is being exploited.

Where the bug sits

The NVD entry, which as of 5 November has no CVSS score and is awaiting analysis, describes a possible out-of-bounds write due to a heap buffer overflow in onOutputReceived of FrameDecoder.cpp. Public descriptions don't say how an attacker would reach that code, Hive Security notes in its patch-verification write-up.

The same bulletin carries two more critical remote code execution flaws in the System component, CVE-2026-58876 and CVE-2026-58936, across the same Android versions.

A 216-flaw month

SecurityWeek counts 119 flaws at the 2026-11-01 patch level in the runtime, Framework and System, plus 97 in kernel and chipset components from Arm, Imagination, MediaTek, Unisoc and Qualcomm at 2026-11-05. Google pushed 17 of them early through Google Play system updates. CVE-2026-58868 isn't one of those, so a recent Play system update does not fix it.

Samsung has listed CVE-2026-58868 among the critical items in its November 2026 Galaxy security bulletin. As of 5 November, the newest Pixel update bulletin is October's.

Which patch level fixes it

A phone is protected from CVE-2026-58868 at security patch level 2026-11-01 or later; 2026-11-05 covers every issue in the bulletin, including the chipset fixes. Hive Security points owners to Settings → About phone → Android version for the date, though labels vary by maker. A Galaxy, Pixel or other handset still showing a 2026-10 date there is exposed until its maker ships the November build.