# Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868) · pwn.watch > Google's Android Security Bulletin for November 2026, published Nov 2, says the most severe issue is CVE-2026-58868, a critical Framework remote-code-execution bug that needs no additional privileges and no user interaction. It affects Android 14, 15, 16, 16-qpr2 and 17. The same 2026-11-01 patch level also includes two critical System RCEs (CVE-2026-58876, CVE-2026-58936) and the already-tracked SMS-of-death DoS (CVE-2026-58882). The 2026-11-05 patch level adds kernel and vendor fixes. Update devices to security patch level 2026-11-01 or later (2026-11-05 for the full set). Google said it notifies partners at least a month before publication; there was no claim of in-the-wild exploitation for CVE-2026-58868 in the bulletin. Page: https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868 · generated 2026-11-04T14:30:54.317Z ## Status - Severity: critical · status: live · patch: patched - Product: Android (Framework / System) - Started: 2026-11-02 - CVEs: CVE-2026-58868, CVE-2026-58876, CVE-2026-58936 - Affected: Android 14, 15, 16, 16-qpr2, 17 (CVE-2026-58868 and related Framework/System issues) - Fixed in: Security patch level 2026-11-01 or later; Security patch level 2026-11-05 or later (full bulletin including kernel/vendor) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/feed.xml - JSON Feed: https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868.json - This file: https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868/llms.txt ## Updates (newest first) - 2026-11-04: The Hacker News and SecurityWeek cover the critical no-interaction RCE and the broad November patch set (200+ issues in some counts). (https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html) - 2026-11-02: Google publishes the Android Security Bulletin—November 2026. Most severe: CVE-2026-58868 critical Framework RCE with no user interaction; 2026-11-01 and 2026-11-05 patch levels defined. (https://source.android.com/docs/security/bulletin/2026/2026-11-01) ## Fix brief # Security brief: Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868) Source: https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868 · status: live · severity: critical · updated Nov 4, 2026, 11:40 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Google's Android Security Bulletin for November 2026, published Nov 2, says the most severe issue is CVE-2026-58868, a critical Framework remote-code-execution bug that needs no additional privileges and no user interaction. It affects Android 14, 15, 16, 16-qpr2 and 17. The same 2026-11-01 patch level also includes two critical System RCEs (CVE-2026-58876, CVE-2026-58936) and the already-tracked SMS-of-death DoS (CVE-2026-58882). The 2026-11-05 patch level adds kernel and vendor fixes. Update devices to security patch level 2026-11-01 or later (2026-11-05 for the full set). Google said it notifies partners at least a month before publication; there was no claim of in-the-wild exploitation for CVE-2026-58868 in the bulletin. Severity detail: Critical Framework RCE (CVE-2026-58868) with no user interaction on Android 14–17; bulletin also has critical System RCEs - Product: Android (Framework / System) - CVE / advisory ids: CVE-2026-58868, CVE-2026-58876, CVE-2026-58936 ## Affected versions - Android 14, 15, 16, 16-qpr2, 17 (CVE-2026-58868 and related Framework/System issues) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Security patch level 2026-11-01 or later - Security patch level 2026-11-05 or later (full bulletin including kernel/vendor) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Check Settings → About phone → Android security update. Install 2026-11-01 or later (prefer 2026-11-05). OEM schedules vary; Pixel and major OEMs usually ship within days of the bulletin. ## Latest updates - Nov 4, 2026: The Hacker News and SecurityWeek cover the critical no-interaction RCE and the broad November patch set (200+ issues in some counts). - Nov 2, 2026: Google publishes the Android Security Bulletin—November 2026. Most severe: CVE-2026-58868 critical Framework RCE with no user interaction; 2026-11-01 and 2026-11-05 patch levels defined. ## Advisories - [Android Security Bulletin—November 2026](https://source.android.com/docs/security/bulletin/2026/2026-11-01) (Android Open Source Project / Google) - [NVD - CVE-2026-58868](https://nvd.nist.gov/vuln/detail/CVE-2026-58868) (NVD) ## Write-ups & news - [Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction](https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html) --- Machine-readable: https://pwn.watch/i/android-november-2026-security-bulletin-cve-2026-58868.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.