Google Android · Exploitation reported

Android Patches Zero-Click RCE CVE-2026-58868; Over 40% Too Old for Fix

Nov 03, 2026 · 1 min read

Android's November 2026 bulletin patches more than 200 vulnerabilities, including the most severe one, CVE-2026-58868, a critical remote code execution flaw in the Framework component that needs no user interaction. The bug is a heap buffer overflow in the onOutputReceived function (FrameDecoder.cpp), affects Android 14 through 17, and is fixed in the 2026-11-01 patch level or later; there is no public PoC and no confirmed attacks. Google's own data shows over 40% of Android devices run versions too old for the fix; bring managed devices to the 2026-11-05 patch level or later.

By HIFY Radar newsroom Updated 11/03/2026 08:11 PM Get this every day →← Back to the feed 3 sources

CriticalVulnerabilityExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Google has patched a critical Android flaw, CVE-2026-58868, allowing remote code execution on phones without any user interaction. The fix shipped in the November 2026 bulletin, which closes more than 200 vulnerabilities. Google has not flagged the flaw as exploited and no attacks are confirmed.

Why it matters

This class of flaw lets an attacker take over a device without the victim tapping anything, exposing corporate data on work phones. The risk lingers because Google's own data shows over 40% of Android devices run versions too old to receive the fix.

What to do

Require security patch level 2026-11-05 or later on every managed Android device, since it covers all issues in the bulletin. Identify devices that can no longer receive updates and plan upgrade or replacement.

For the technical team

CVE: CVE-2026-58868
Affected: Google Android (atualizações de segurança de novembro de 2026) · Android 14, 15, 16, 16 QPR2 and 17 (list from @DarkWebInformer).
Exploitation: No public PoC and no confirmed in-the-wild attacks, per @DarkWebInformer; Google has not flagged the flaw as exploited, per SecurityWeek.
Fix: Security patch level 2026-11-01 or later fixes CVE-2026-58868 (@DarkWebInformer). Google says patch level 2026-11-05 or later addresses all issues in the bulletin.
Vector: Android Framework component. Heap buffer overflow (out-of-bounds write) in the onOutputReceived function, in FrameDecoder.cpp, while processing media frames. Exploitation needs no additional privileges and no user interaction (zero-click).
More details: The November 2026 bulletin patches more than 200 vulnerabilities, including two dozen critical ones: 119 at the 2026-11-01 level (Android runtime, Framework, System) and 97 at 2026-11-05 (Kernel, Arm, Imagination Technologies, MediaTek, Unisoc, Qualcomm). Framework received 65 fixes, System 53. Google had already shipped 17 fixes via Google Play system updates ahead of the monthly rollout. CVSS not yet assigned to CVE-2026-58868. Google also published bulletins for Android XR and Wear OS.

Timeline

11/03/2026 08:11 PM
Post details the root cause of CVE-2026-58868: a heap buffer overflow in the onOutputReceived function (FrameDecoder.cpp), and lists Android 14 through 17 as affected, with the fix in security patch level 2026-11-01.
11/03/2026 05:51 PM
New post identifies the critical flaw as CVE-2026-58868 and adds that over 40% of Android phones run versions too old for the fix.
11/03/2026 09:26 AM
First report: Android's November bulletin patches over 200 vulnerabilities, including a critical no-interaction RCE.