Google Patches Critical Android Flaw That Could Let Attackers Run Code Without Any User Action

Google has fixed a critical Android flaw, CVE-2026-58868, that could let an attacker run code on a phone remotely without any user action. It affects Android 14 through 17 and is addressed in the November security bulletin. It is a heap buffer overflow in a function called onOutputReceived. Neither the bulletin nor the CVE record explains how an attacker would reach that code. Google's Critical rating assumes Android's built-in protections are turned off or bypassed.

As of November 4, the bulletin reported no attacks exploiting these flaws, and none were in the U.S. CISA Known Exploited Vulnerabilities catalog as of its November 3 update. Phones need security patch level 2026-11-01 or later for this fix. Level 2026-11-05 or later covers every flaw in the bulletin, including kernel and chip maker components. Phone makers and carriers release updates on their own schedules, and the bulletin offers no workaround for phones that cannot yet update. Android 12 and 13 are not listed as affected, though Google's records do not say whether they contain the flaw.

Another Critical flaw, CVE-2026-58882, could allow a remote denial-of-service attack with no user interaction through the code that handles WAP Push messages sent by SMS. A researcher known as Mark B published a write-up on October 29 about a bug in the same function, but the sources do not say whether it is the same issue.