What happened
On November 2, 2026, Google published its November Android Security Bulletin. The most severe issue in it is CVE-2026-58868 in the Framework component, the core layer of the system that apps are built on. Google rates it Critical.
The bug sits in the file FrameDecoder.cpp, where the software may write data outside the area of memory set aside for it. According to Google, this could lead to remote code execution with no additional privileges and without the user doing anything.
Nobody has confirmed exploitation so far. According to The Hacker News, the bulletin did not report any attacks as of November 4, 2026, and the flaw was not in the CISA KEV catalog as of its November 3, 2026 update. The EU Vulnerability Database (EUVD) lists it as EUVD-2026-115598, also with no information about exploitation.
The Hacker News reports that the November bulletin lists 216 vulnerabilities in total, 23 of them rated Critical. This article focuses on CVE-2026-58868.
Why it is dangerous
This is a heap buffer overflow. Picture a shelf with exactly ten slots. If someone forces twelve folders onto it, the last two spill onto the neighbouring shelf and overwrite whatever was there. In a computer, memory overwritten this way can crash an app, and in the worst case an attacker can use it to run their own code.
According to Google, the attacker needs no additional privileges and the user does not have to open or confirm anything. However, neither Google nor the CVE record says how an attacker would reach the vulnerable code. So we do not know whether, for example, sending a file or a message would be enough.
Google explains that its “Critical” rating assumes the protections built into Android and Google’s services are turned off or have been bypassed. In practice these protections make attacks harder, but relying on them alone is not wise.
If an attack succeeded, the attacker could run their own code on the phone. Google does not say what privileges that code would have or what data it could reach. Company phones often hold email, contacts and access to company services, though, so do not put off the update.
CVSS is a 0 to 10 scale describing the technical severity of a flaw. The NVD record does not list a CVSS score for this flaw yet. EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of November 3, 2026, it is 0.21% for this flaw, which is very low. The CISA KEV catalog lists flaws that the U.S. agency CISA tracks as actually exploited, and this flaw is not on it.
Who is affected
The flaw affects devices running Android 14, 15, 16, 16-qpr2 and 17 that do not yet have the November 1, 2026 security patch level or later. The 16-qpr2 label refers to a quarterly update of Android 16.
In a typical company this means work phones and tablets, employees’ personal phones with access to company email, and Android-based devices such as terminals, scanners or kiosks, if they run one of the listed versions.
Google does not list Android 12 and 13 as affected. According to The Hacker News, however, Google’s records do not say whether those versions contain the flaw. Older versions also often no longer receive updates, which is a risk in itself.
How to check if you are affected
On the phone, open Settings, tap About phone (or About tablet), then Android version. There you will find the date of the Android security update and of the Google Play system update. Menu names may differ slightly between manufacturers.
The Android security update date is what matters. If it is November 1, 2026 or later, the device is protected against CVE-2026-58868. The Google Play system update date does not cover this flaw.
If you manage many devices, your MDM console usually shows the Android version and patch level too. An administrator can also read them over a cable with the adb tool if USB debugging is turned on. These commands only read data:
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patchThe first command returns the Android version, the second the security patch level as a year-month-day date.
How to fix it
The flaw is fixed by the November 1, 2026 security patch level or later. The November 5, 2026 level covers every flaw in the November bulletin, including those in the kernel and in chipmaker components. Phone makers and carriers ship updates on their own schedules, though, so some devices will get them later.
- List your company’s Android devices and note their version and patch level.
- On each device, open Settings, go to System or Software update and check for updates.
- Install the available update and restart the device.
- After the restart, confirm the security update date is November 1, 2026 or later.
- In your MDM, set a rule that flags devices with an old patch level or limits their access to company data.
Start with the most sensitive devices: phones used by management, accounting and IT administrators first, then devices with access to company email and systems, then everything else.
Google gives no workaround for devices that cannot install the update yet. Keep Google Play Protect turned on, which Google lists among its protections, and avoid installing apps from outside Google Play. If the manufacturer no longer ships updates for a model, consider replacing it.
What if you may already be compromised
Neither Google nor The Hacker News has published indicators of compromise or reports of attacks. A compromise is therefore unlikely, but it cannot be ruled out. If you have concerns, look for:
- unknown apps, especially those with device admin or accessibility permissions
- unexpected sign-ins to company accounts from unfamiliar locations or devices
- warnings from Google Play Protect or the security tool in your MDM
- unusual data or battery usage and repeated app crashes
If you find any of these, disconnect the device from company services, then change passwords and end active sessions from a different, clean device. If you suspect company data has leaked, or the phone belongs to someone with broad access, bring in a mobile security specialist.