Google Patches Critical Android RCE Flaw Affecting Android 14-17

Critical Vulnerability Details

Google's November security bulletin details a critical Android flaw, CVE-2026-58868, which could enable remote code execution on affected devices without requiring any user interaction. This vulnerability is present in Android versions 14, 15, 16, and 17. The flaw is described as a possible out-of-bounds write resulting from a heap buffer overflow within the onOutputReceived function in FrameDecoder.cpp.

Patch Availability and Distribution

The fix for CVE-2026-58868 is included in the Android security patch level 2026-11-01 or later. Device manufacturers and carriers are responsible for distributing these updates to users on their own schedules. As of November 4, Google had not reported any active exploitation of this flaw, and it was not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog.

Checking Device Security Status

Users can check their phone's security patch level by navigating to Settings > About phone (or About tablet) > Android version. The 'Android security update' date indicates the device's current patch level. A date of 2026-11-01 or later confirms the fix for CVE-2026-58868 and other flaws in Framework, System, and Android runtime components. A date of 2026-11-05 or later covers all flaws in the November bulletin, including those in the kernel and third-party components.

Additional Critical Flaws

The November bulletin also mentions another critical flaw, CVE-2026-58882, which could lead to a remote denial-of-service attack without user interaction. This vulnerability is located in the decodeWapPdu function within Android's code for WAP Push messages received via SMS. Some fixes for Android 10 and later may also be delivered via Google Play system updates, though CVE-2026-58868 is not among them.