Google Fixes Zero-Click Remote Code Execution Vulnerability in Android

Google has released its November security bulletin addressing a critical vulnerability that allows attackers to remotely execute code on Android devices without requiring any user interaction. The flaw, tracked as CVE-2026-58868, affects mobile devices running Android 14 through Android 17 and represents one of the most severe issues resolved in the operating system's latest monthly release.

As reported by The Hacker News, the vulnerability was disclosed alongside more than two hundred other security flaws. Google confirmed that it had not observed active in-the-wild exploitation of the issue as of November 4, and the vulnerability was not listed in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency as of November 3.

Technical Details of CVE-2026-58868

The primary flaw is an out-of-bounds write triggered by a heap buffer overflow in the onOutputReceived function, located inside the FrameDecoder.cpp file. The public advisory and the vulnerability's CVE entry do not detail the exact vector through which an unauthenticated remote attacker triggers this code path.

Google assigned CVE-2026-58868 a severity rating of Critical. According to the company, this assessment assumes that standard platform defenses and service-level protections are either disabled or successfully bypassed by the threat actor. Older releases, including Android 12 and Android 13, are not listed as affected in the security documentation, though records do not clarify whether the vulnerable code is present in those branches.

Critical Flaws in Telephony and System Components

In total, Google's November bulletin details 216 vulnerabilities, with 23 classified as Critical. Among them is CVE-2026-58882, a critical denial-of-service vulnerability affecting Android's text-messaging architecture that also requires zero user interaction.

CVE-2026-58882 resides in decodeWapPdu, a function designed to process WAP Push messages received through SMS. On October 29, an independent security researcher writing as Mark B published technical details regarding an "SMS of Death" bug in the same function, though official documentation does not explicitly link the research to the CVE identifier.

According to the researcher's published findings, receiving a single malformed WAP Push payload causes the core com.android.phone service to crash immediately. The crash terminates any active cellular communication, including emergency phone calls, without the message ever appearing in the recipient's messaging application. Because the device attempts to process the stored payload upon rebooting, vulnerable phones can enter a continuous crash loop until the message is purged. A public proof-of-concept application demonstrating this behavior has been released.

The bulletin also resolves two additional Critical remote code execution bugs in Android's System component, identified as CVE-2026-58876 and CVE-2026-58936. Furthermore, the update addresses six critical vulnerabilities in the Linux kernel, including two bugs in Bluetooth networking code, the most severe of which permits remote privilege escalation without user engagement. Chipset vendors, including MediaTek and Qualcomm, contributed fixes for out-of-bounds writes in modem and closed-source proprietary firmware.

Patch Levels and Deployment Schedules

Google maintains two security patch levels to help hardware partners distribute common framework corrections more quickly:

• 2026-11-01 patch level: Remediates vulnerabilities in core Framework, System, and Android runtime modules, including CVE-2026-58868.
• 2026-11-05 patch level: Encompasses all fixes from the initial tier plus patches for the kernel, proprietary components, and drivers from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm.

Certain modern devices running Android 10 or later can receive select framework patches through Google Play system updates, including the critical CVE-2026-58876. However, CVE-2026-58868 is not eligible for delivery through Google Play and requires a full operating system firmware update provided by the device manufacturer or carrier.

What You Should Do

Google has not published temporary workarounds for devices that cannot immediately install the updates, making firmware patch installation the only available remediation.

To verify the security status of an Android device, navigate to Settings, select About phone (or About tablet), and tap Android version. Review the displayed dates under Android security update and Google Play system update.

Administrators managing corporate Android fleets should enforce policies requiring devices to report a security patch level of 2026-11-01 or 2026-11-05. Enterprise environments should accelerate rollout validation as soon as original equipment manufacturers deliver platform updates for supported handsets.