Google’s November Android Security Bulletin leads with CVE-2026-58868, a critical flaw in the operating system’s Framework component that can lead to remote code execution without any action from the phone’s owner. The bulletin went up on Nov. 2 and was updated on Nov. 6. It lists fixes for Android 14, 15, 16, 16 QPR2 and 17.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Phones need a security patch level of 2026-11-05 or later to be covered for everything in the bulletin. The Framework fix itself arrives with the 2026-11-01 level, which means a phone showing the earlier date has the repair while one showing a September or October date does not.
CVE-2026-58868 and what Google says about it
The Android Security Bulletin for November 2026 says the most severe of the issues is a critical vulnerability in the Framework component, and states plainly that user interaction is not needed for exploitation. The entry is a remote code execution rating with no additional execution privileges required, tracked internally as A-486464711. The bulletin page gives no longer description of the bug itself. Affected versions are given in the bulletin’s own terms, as updated AOSP versions 14, 15, 16, 16-qpr2 and 17, so the fix tracks the open-source branches rather than any single phone brand. Google’s wording that user interaction is not needed separates this entry from the usual bug that needs a victim to tap a link or install an app.
Secondary write-ups fill in some detail. Rescana’s advisory describes a possible out-of-bounds write from a heap buffer overflow in a function called onOutputReceived inside FrameDecoder.cpp, and the Daily Security Review summary says a crafted media file or image could be enough to run code on an unpatched device. Google’s page does not confirm that mechanism, so it should be read as outside analysis.
How big the November release is
SecurityWeek counted more than 200 vulnerabilities across the two patch levels, with roughly two dozen rated critical. Its tally puts 119 flaws in the 2026-11-01 level, led by 65 in Framework and 53 in System, and 97 in the 2026-11-05 level covering Kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm parts. The Daily Security Review put the total at 216 and the critical count at 23.
The counts differ by a few items between outlets, and the bulletin’s own tables are long enough that totals are easy to misread, so the safest reading is the bulletin’s single instruction: reach 2026-11-05 or later. Beyond Framework, the critical list includes two more remote code execution bugs in System, CVE-2026-58876 and CVE-2026-58936, plus privilege-escalation and denial-of-service entries. SecurityWeek said most of the second batch is high severity, with more than a dozen critical flaws in Bluetooth, pKVM, HID, a MediaTek modem component and a closed-source Qualcomm component. It added that 17 of the System flaws were rolled out earlier through Google Play system updates, and that the Android XR and Wear OS updates carry their own high-severity fixes.
Exploitation status and who is covered
As of the Nov. 4 checks reported by Rescana, Google had reported no exploitation, and CVE-2026-58868 was absent from the Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities. Rescana noted that federal scoring data rated the three critical remote code execution bugs as not yet exploited but automatable. The Daily Security Review likewise reported no exploitation in the wild. That outlet lists two more no-interaction remote code execution bugs: CVE-2026-58936, a use-after-free in libpng’s png_set_tRNS function, and CVE-2026-58876, a use-after-free in Media Codecs delivered through Google Play system updates.
The fixed versions run from Android 14 upward. Rescana pointed out that the bulletin lists nothing below Android 14, so a device on Android 13 or earlier should not be assumed protected. Neoteo’s note on the five listed releases reaches the same list of Android 14, 15, 16, 16 QPR2 and 17.
Checking a phone’s patch level
Google’s help page on updating Android notes that update timing depends on the device, the manufacturer and the carrier, and that older handsets may not support the newest Android versions. It walks through the check: open Settings, tap About phone, then Android version, and read the security update date. Updates are reached through System and Software updates, preferably over Wi-Fi with the battery charged to at least 75 percent. Pixel phones install updates in the background and finish after a restart. Rescana’s author, writing for organizations and not for Google, suggests checking the security patch property across a fleet, setting a compliance deadline and restricting sensitive app access for devices that miss it.
For other brands, timing depends on the manufacturer and carrier, which is the practical gap in a monthly bulletin: Google publishes the fix on a fixed day, and the date a particular handset reaches 2026-11-05 is set by someone else. Rescana’s note that no workaround disabling the vulnerable component has been published leaves updating as the only mitigation on record.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Neanderthals in Spain carved a wooden object that matches nothing archaeologists have ever found
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
- Shaq spent $1.3 million on three Rolls-Royce Phantoms to prove a point to a salesman
- Over 20 trillion gallons of rain fell on the Four Corners states and Nevada in two weeks
