Google said in its November Android security bulletin that it fixed a critical flaw in the Android Framework. The Hacker News reported that the flaw is CVE-2026-58868 and affects Android 14 through 17. Google said an attacker could run code on a phone remotely. This needs no user action and no extra access. Phones need a security patch level of 2026-11-01 or later. The Hacker News counted 216 flaws in the bulletin, 23 of them rated Critical.
The Hacker News said the bug is a heap buffer overflow, meaning a write past the end of a memory area, in a file called FrameDecoder.cpp. As of November 4, the bulletin reported no attacks. A U.S. government catalog of exploited flaws, updated November 3, listed none of them. Neither the bulletin nor the CVE record says how an attacker would reach the code. Android 12 and 13 are not listed as affected, but Google's records do not say whether they contain the flaw. The bulletin offers no workaround. Phone makers ship the fix on their own schedules.
Anyone who manages or buys Android phones can check each device's security patch level against 2026-11-01. Google's Critical rating assumes Android's built-in protections are off or bypassed. Because makers ship fixes on their own schedules, devices in one fleet may carry different patch levels.