Google has patched a critical Android flaw that could let an attacker run code on a phone without the owner doing anything at all. The vulnerability, tracked as CVE-2026-58868, sits in the Android Framework and affects phones running Android 14 through 17 — effectively every Android version still receiving security support.

The flaw is a heap buffer overflow in a media-decoding file, FrameDecoder.cpp, that can cause an out-of-bounds write. Google rates it Critical, its highest severity band, and says no user interaction is needed for exploitation. The company has not reported any attacks using the flaw, and it did not appear in the US CISA catalogue of known exploited vulnerabilities as of 3 November.

How to check your phone

The fix arrives with security patch level 2026-11-01 or later. Owners can check their level in Settings, under About phone and then Android version. A date of 2026-11-05 or later covers every flaw in the November bulletin, including kernel and chipset fixes. Phones receive the update on schedules set by their maker and carrier, so many devices will wait weeks for it.

A bulletin with 216 fixes

Google's November bulletin lists 216 vulnerabilities, 23 of them rated Critical. Two more Critical remote-code flaws sit in the System component, CVE-2026-58876 and CVE-2026-58936, and a separate Critical flaw, CVE-2026-58882, could crash a phone — including during an emergency call — with a single malformed text message. Android 12 and 13 are not listed as affected by CVE-2026-58868, though Google has not said whether they contain the bug.

[Source: The Hacker News](https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html) | [Source: Aviatrix Threat Research](https://aviatrix.ai/threat-research-center/google-patches-critical-android-rce-cve-2026-58868-november-2026/)