{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868) · updates",
  "home_page_url": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868",
  "feed_url": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/feed.json",
  "description": "Google's Android Security Bulletin for November 2026, published Nov 2, says the most severe issue is CVE-2026-58868, a critical Framework remote-code-execution bug that needs no additional privileges and no user interaction. It affects Android 14, 15, 16, 16-qpr2 and 17. The same 2026-11-01 patch level also includes two critical System RCEs (CVE-2026-58876, CVE-2026-58936) and the already-tracked SMS-of-death DoS (CVE-2026-58882). The 2026-11-05 patch level adds kernel and vendor fixes. Update devices to security patch level 2026-11-01 or later (2026-11-05 for the full set). Google said it notifies partners at least a month before publication; there was no claim of in-the-wild exploitation for CVE-2026-58868 in the bulletin.",
  "language": "en",
  "_pwn": {
    "slug": "android-november-2026-security-bulletin-cve-2026-58868",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/feed.xml",
    "llms": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/llms.txt",
    "json": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868#2026-11-04-b0bac0fc",
      "url": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868#2026-11-04-b0bac0fc",
      "title": "Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868): The Hacker News and SecurityWeek cover the critical no-interaction RCE and the broad November patch set (200+ issues in some counts).",
      "content_text": "Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868): The Hacker News and SecurityWeek cover the critical no-interaction RCE and the broad November patch set (200+ issues in some counts).\n\nSource: https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868#2026-11-02-df1ab293",
      "url": "https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868#2026-11-02-df1ab293",
      "title": "Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868): Google publishes the Android Security Bulletin—November 2026. Most severe: CVE-2026-58868 critical Framework RCE with no user interaction; 2026-11-01 and 2026-11-05 patch levels defined.",
      "content_text": "Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868): Google publishes the Android Security Bulletin—November 2026. Most severe: CVE-2026-58868 critical Framework RCE with no user interaction; 2026-11-01 and 2026-11-05 patch levels defined.\n\nSource: https://source.android.com/docs/security/bulletin/2026/2026-11-01",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01",
      "tags": [
        "critical"
      ]
    }
  ]
}