Google has fixed a critical Android security flaw that could allow remote code execution without the user tapping the screen or approving any action. The vulnerability, tracked as CVE-2026-58868, is the most severe item in the November 2026 Android security bulletin, published on November 2.
According to the official bulletin, the flaw sits in the system's Framework component and is caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp, part of the code that generates thumbnails and processes media such as photos and videos. Google rates it critical because it could lead to remote code execution with no additional execution privileges needed and no user interaction. It affects devices running Android 14, 15, 16, 16 QPR2 and 17.
The November bulletin fixes 216 vulnerabilities, 23 of them rated critical. Among them are two more remote code execution flaws in the System component, CVE-2026-58876 and CVE-2026-58936, both scored 9.8 out of 10 on the CVSS scale. The same bulletin also includes the flaw nicknamed “SMS of Death” (CVE-2026-58882), which can crash the phone service — a topic Geekiki already covered in another article.
Context matters: Google says it is not aware of any active exploitation of these flaws, and no public proof-of-concept exploit is known. The bulletin also does not explain how an attacker would reach the vulnerable code, and “zero-click” does not automatically mean every device can be reached over the internet. Android platform protections and Google Play Protect, according to Google, reduce the likelihood of successful exploitation.
The fix is in security patch level 2026-11-01 or later, and the full bulletin requires level 2026-11-05. Rollout depends on each manufacturer and carrier. The bigger warning concerns older phones: according to distribution data cited by Cybernews, 43.6% of active Android devices still run Android 13 or older, which no longer receive security fixes — those phones will not get the patch.
To check your patch level, go to Settings > Security and install the November update as soon as it is available for your device.
Image credit: Android robot, by Google / Irina Blok, via Wikimedia Commons (CC BY 3.0).
Sources:
- Android Security Bulletin — November 2026 (Google)
- Cybernews — Android zero-click flaw fixed, but many phones may miss patch
- Security Affairs — CVE-2026-58868: Critical Android Bug Could Let Attackers Run Remote Code
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts on X and sources from the internet. Always consult the original sources listed above.
Muse
