Android November 2026 Bulletin Fixes 216 Flaws, Including Zero-Click Framework RCE CVE-2026-58868 Across Android 14 to 17
Google's November Android update patches 216 vulnerabilities, 23 of them Critical, led by a no-interaction remote code execution bug in the Framework's media frame decoder.
What Happened
Google published the Android Security Bulletin for November 2026 on 2 November. By public counts it is one of the largest monthly Android updates on record: 216 CVEs, of which 23 are rated Critical and the rest High.
The headline issue is CVE-2026-58868, a Critical remote code execution flaw in the Android Framework. In the bulletin's words, it "could allow remote code execution without additional execution privileges" and needs no user interaction. It affects Android 14, 15, 16, 16 QPR2 and 17.
As of 4 November the bulletin did not report any exploitation, and none of the Critical RCE bugs were in CISA's Known Exploited Vulnerabilities catalog. That gives defenders a rare chance to patch before attackers move.
Technical Details
Public analysis describes CVE-2026-58868 as a heap buffer overflow, an out-of-bounds write, in the onOutputReceived function of FrameDecoder.cpp. That code handles decoded media frames. Media parsing has been a common route to remote code execution on Android for years, because attacker-supplied content can reach it without the user knowingly opening anything.
The bulletin rates severity on the assumption that platform and service mitigations are disabled or bypassed. In practice, exploitation usually also needs a sandbox escape or a second bug. Still, a no-click entry point is the hardest part of a mobile exploit chain to find.
Two more Critical RCE flaws sit in the System component, also affecting Android 14 through 17:
- CVE-2026-58876: remote code execution
- CVE-2026-58936: remote code execution
Other Critical issues in the System component include privilege-escalation bugs CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984, and denial-of-service bugs CVE-2026-58814 and CVE-2026-58882. CVE-2026-58882 is the "SMS of Death" flaw we covered separately, where a single invisible text can drop calls and trap a phone in a reboot loop.
At the kernel level, the bulletin lists Critical escalation-of-privilege flaws in:
- Bluetooth: CVE-2026-53256, CVE-2026-89774
- pKVM, the protected hypervisor: CVE-2026-59044, CVE-2026-59045, plus an information-disclosure bug, CVE-2026-59048
- HID: CVE-2026-80604
There is also a Critical Qualcomm closed-source component flaw, CVE-2026-25285.
When the bulletin came out, NVD had not yet scored the headline CVEs. They were still awaiting analysis.
Patch Levels Explained
Google ships the fixes in two patch levels:
- 2026-11-01 covers the Android runtime, Framework, System and Google Play system update issues, including CVE-2026-58868.
- 2026-11-05 includes everything above plus kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm fixes.
Only a device at 2026-11-05 or later has every fix in the bulletin. Some components also ship through Google Play system updates (Project Mainline): Media Codecs, Media Framework, MediaProvider, Profiling, Telephony core and Wi-Fi. Devices can receive those fixes without a full firmware update.
Who Is Affected
Any phone or tablet on Android 14 through 17 that lacks the November patch level. Pixel devices usually get updates first. Samsung, Xiaomi, OnePlus, Motorola and other manufacturers follow on their own schedules, and carrier-locked devices can lag further. Phones whose security support has ended will not get the fixes.
What To Do Now
- Users: open Settings, then Security & privacy, then System & updates, and install the latest security update and Google Play system update. Check that the security patch level reads 5 November 2026 or later.
- Enterprise mobility teams: use your MDM to report patch levels across the fleet. Set compliance rules that flag devices below 2026-11-01 now, then tighten to 2026-11-05 once your main manufacturers ship it.
- Out-of-support devices: plan to replace them. They will never receive these fixes.
- Developers and testers can check a connected device's patch level with:
adb shell getprop ro.build.version.security_patchWhy It Matters
A zero-click remote code execution flaw in core Android media handling is exactly what commercial spyware vendors look for. Patch analysis usually begins within days of a bulletin. Because Android updates are fragmented, the gap between Google publishing a fix and the average device receiving it is where most real-world risk sits.
The size of this bulletin, 216 CVEs in one month, also reflects the wider trend of faster, often AI-assisted bug discovery across large codebases. That makes keeping up with monthly mobile patches an operational necessity rather than a best practice.
