Android November 2026 Security Bulletin: Critical No-Interaction RCE (CVE-2026-58868) — Prepare Mobile Fleets Now

Status: Google published the Android Security Bulletin for November 2026 on 2 November 2026. Security patch level 2026-11-05 or later addresses every issue in it. Google has not reported exploitation of any of these vulnerabilities. As of our 4 November 2026 check, none of the 216 CVEs listed is in CISA's Known Exploited Vulnerabilities (KEV) catalog. Fixes reach devices through each manufacturer's own update schedule, so most Android devices will not have them yet.

Executive Summary

The November 2026 Android Security Bulletin (Android Security Bulletin—November 2026) lists 216 CVEs: 23 rated Critical and 193 rated High. In Google's words, the most severe is "a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." That issue is CVE-2026-58868.

Two more Critical remote code execution (RCE) flaws sit in the System component: CVE-2026-58876 and CVE-2026-58936. The second patch level adds eight Critical issues in MediaTek modem components, six Critical Linux kernel issues and one Critical issue in a Qualcomm closed-source component.

Some context keeps this in proportion. Google's ratings describe what exploitation "would possibly" do "assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed." The bulletin says nothing about attacks in the wild, and CISA's SSVC entries on the NVD records for the three Critical RCEs say "Exploitation: none." We rate this advisory High. A remote code execution flaw that needs no user interaction is serious enough to plan for now. We do not rate it Critical, because nobody has reported exploitation and the platform mitigations still stand between a bug and a working attack.

For third-party risk teams, the problem is not one patch. It is how long patches take to arrive. Google's bulletin is only the start. Each phone and tablet maker then builds, tests and ships its own update, and many older or low-cost devices never get one. Vendors whose staff read your email, approve payments, run MDM or field-service apps, or hold your data on Android devices inherit that lag.

What Happened

Bulletin published (confirmed). Google published the bulletin (version 1.0) on 2 November 2026. It says: "Security patch levels of 2026-11-05 or later address all of these issues." Google adds that it notifies "Android partners of all issues at least a month before publishing the bulletin." It also says that "within 48 hours after the initial publication of this bulletin," Google will publish the source code patches to the Android Open Source Project (AOSP) and then update the bulletin with the AOSP links. When we fetched the bulletin on 4 November 2026 at 09:13 Asia/Nicosia (UTC+2), it was still version 1.0.

CVE records (confirmed). NVD published the CVE records on 2 November 2026 at about 22:17 Asia/Nicosia (20:17 UTC). On 4 November, CVE-2026-58868, CVE-2026-58876 and CVE-2026-58936 were all "Awaiting Analysis," with no CVSS score from either NVD or the CNA. Google's bulletin uses its own Critical/High/Moderate ratings rather than CVSS, so this advisory cites no CVSS numbers (NVD CVE-2026-58868).

Exploitation status. No exploitation has been reported. This bulletin has no note about "limited, targeted exploitation," the wording Google uses when it knows of active attacks. None of the 216 CVEs appears in CISA KEV (catalog version 2026.11.03, checked 4 November 2026). CISA's SSVC entries for the three Critical RCEs record Exploitation "none," Automatable "yes" and Technical impact "total." "Automatable" is the reason to prepare now rather than at the next routine patch cycle. It is not evidence of attacks. We will update this post if Google, CISA or a chipset vendor reports exploitation.

Technical Information

The bulletin sorts fixes into two security patch levels, and that split matters when you check vendor answers:

• 2026-11-01 covers Android runtime, Framework and System (119 CVEs). Some of these components also ship as Google Play system updates (Project Mainline).
• 2026-11-05 adds the kernel and chipset-vendor components: Arm, Imagination Technologies, MediaTek, Unisoc, Qualcomm and Qualcomm closed-source (97 CVEs). It also includes everything in 2026-11-01 and all earlier bulletins.

A device reporting 2026-11-01 has the Framework and System fixes but may still lack the kernel and chipset fixes. Only 2026-11-05 or later covers everything in this bulletin.

Critical remote code execution in Framework and System

Each CVE record says the flaw "could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." The descriptions point at media and image handling (a frame decoder and PNG processing), where an attacker controls the incoming content. The bulletin does not say which delivery paths, such as messaging, browsing or file previews, reach the vulnerable code. We will not guess. No proof-of-concept has been published, and we do not describe how these flaws could be exploited.

The bulletin's Google Play system updates list puts CVE-2026-58876 under the Media Codecs Mainline component. Devices that get Google Play system updates may therefore receive that fix through Google Play, separately from the manufacturer's full firmware update. Google notes that "for some devices on Android 10 or later, the Google Play system update will have a date string that matches the 2026-11-01 security patch level." The bulletin does not place CVE-2026-58868 or CVE-2026-58936 on that list, so those two depend on the manufacturer's update.

Other Critical issues at the 2026-11-01 level

The System component also has five more Critical issues: three elevation-of-privilege flaws (CVE-2026-55275, CVE-2026-55283, CVE-2026-58984) and two denial-of-service flaws (CVE-2026-58814, CVE-2026-58882). The Framework section lists one more RCE, CVE-2026-58857, which Google rates High.

Critical issues at the 2026-11-05 level

• MediaTek modem (8 Critical): CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545, CVE-2026-20546, CVE-2026-20547, CVE-2026-20548 and CVE-2026-20549, all in the "Modem" subcomponent. The bulletin says that "the severity assessment of these issues is provided directly by MediaTek." It gives no vulnerability type for these entries, and their references are marked as not publicly available. We do not label them RCE. MediaTek's own bulletin is the place to get details. The baseband modem handles cellular traffic outside the main Android OS, so these fixes depend completely on the device maker shipping updated MediaTek firmware.
• Kernel (6 Critical): elevation of privilege in Bluetooth (CVE-2026-53256, CVE-2026-89774), HID (CVE-2026-80604) and pKVM (CVE-2026-59044, CVE-2026-59045), plus information disclosure in pKVM (CVE-2026-59048). The bulletin says the most severe kernel issue "could lead to remote escalation of privilege with no additional execution privileges needed."
• Qualcomm closed-source (1 Critical): CVE-2026-25285. Its severity is "provided directly by Qualcomm," and details are in Qualcomm's own bulletin.

The remaining entries are rated High. They cover Arm Mali and CPU, Imagination PowerVR GPU, Unisoc modem and uboot, and Qualcomm components. Our full table of every CVE listed on the bulletin is kept with this advisory's working notes. The authoritative list is the bulletin itself.

Affected Product Versions

• AOSP versions with fixes: Android 14, 15, 16, 16 QPR2 and 17, as listed per CVE on the bulletin. Some CVEs list only some of these versions.
• Chipset-specific issues: these affect only devices built on MediaTek, Qualcomm, Unisoc, Arm Mali/CPU or Imagination PowerVR hardware, as listed per subcomponent.
• Fixed state: security patch level 2026-11-05 or later covers every issue. 2026-11-01 covers only the Framework, System and Android runtime issues.
• Older Android releases: the bulletin lists no fixed AOSP versions below Android 14. Do not assume a device on Android 13 or earlier is protected. Ask its manufacturer whether it still gets security updates.

AOSP bulletin vs. OEM rollout. The bulletin is not a firmware release for your devices. Pixel, Samsung, Motorola and other manufacturers each publish their own update schedules and their own device or partner bulletins, which the bulletin points to. Carrier-locked models can get updates later than unlocked ones. Devices past their manufacturer's support window may never get the 2026-11-05 level. On 4 November, two days after publication, you should expect most enterprise and contractor Android devices to still report an October-or-earlier patch level. That is our expectation from normal rollout timing, not a measured figure. That is normal for this stage of the rollout, not a sign that anyone is negligent.

Workaround and Mitigation

Google's guidance in the bulletin is to update. It encourages "all users to update to the latest version of Android where possible," and tells partners to "fix all issues in this bulletin and use the latest security patch level." It also notes that Google Play Protect "is enabled by default on devices with Google Mobile Services, and is especially important for users who install apps from outside of Google Play."

The bulletin publishes no workaround that switches off the vulnerable components. Practical steps for defenders. These are our recommendations, not Google's:

1. Inventory patch levels. Use your MDM/EMM to report ro.build.version.security_patch across corporate and BYOD Android devices. Sort them into 2026-11-05 or later, 2026-11-01, and older.
2. Push updates as manufacturers release them. Turn on automatic system updates, and make sure Google Play system updates are not blocked by policy. The bulletin lists CVE-2026-58876 under the Media Codecs Mainline component, so that fix may arrive through Google Play.
3. Set a compliance date in MDM. Flag devices that have not reached the 2026-11-05 level within the window your policy allows after the manufacturer releases it. Limit their access to email, SSO and sensitive apps until they comply.
4. Retire or restrict unsupported devices. Devices on Android 13 or earlier, or past manufacturer support, should not keep full access to corporate data.
5. Keep Play Protect on and limit sideloading. Block installs from unknown sources on managed profiles. This does not fix the bugs, but it reduces attack surface while you wait for updates.
6. Watch for changes. Re-check the bulletin for AOSP links and revisions, the MediaTek and Qualcomm bulletins, and CISA KEV.

Indicators of Compromise

None published. The bulletin and the CVE records contain no indicators of compromise: no hashes, domains, IPs, file names or log signatures. That fits with no reported exploitation. We have not created our own IoCs.

The useful signal for defenders right now is patch level, not compromise artifacts. A device below 2026-11-05 lacks the fixes. It is not necessarily compromised. If exploitation is reported later, look for IoCs from Google, the chipset vendors or CISA first.

TPRM: What to Do With Vendors Running Android Fleets Today

Android devices in your supply chain are rarely your own. Field technicians, logistics drivers, outsourced support agents, clinicians on partner devices and MSP staff often reach your data or systems from phones and tablets that a vendor manages, or doesn't manage at all. The risk is the time between Google's bulletin and the vendor's devices reaching 2026-11-05. Send focused questions to vendors whose staff or apps handle your data on Android:

1. Do you manage Android devices that access our data or systems through an MDM/EMM? If so, which one, and does it cover BYOD and contractor devices?
2. What share of those devices report security patch level 2026-11-05 or later today, and what share report 2026-11-01? What is your target date for full coverage of the November 2026 bulletin?
3. How do you handle devices whose manufacturer has not shipped the update yet, or never will? Do you restrict, quarantine or retire them?
4. Do your Android apps or devices that we depend on (field-service, point-of-sale, logistics scanners, rugged tablets) run on MediaTek or other chipsets named in the bulletin? When will their makers ship firmware?
5. Will you tell us if Google, a chipset vendor or CISA reports exploitation of these CVEs before your fleet is patched?

Start with vendors whose Android devices reach email, SSO, payment approval or regulated data, and vendors that run kiosk or rugged fleets from smaller manufacturers, which often patch more slowly. Do not expect "fully patched" this week. Expect a plan, a number and an exception process, and compare them with what you can verify. Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.

Need help working through mobile-fleet suppliers still below Android patch level 2026-11-05? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• Google / AOSP: Android Security Bulletin—November 2026 (published 2 Nov 2026, v1.0 at fetch)
• NVD: CVE-2026-58868, CVE-2026-58876, CVE-2026-58936 (Awaiting Analysis; CISA SSVC Exploitation: none)
• KEV status, checked 4 Nov 2026: CVE-2026-58868, CVE-2026-58876 and CVE-2026-58936 are not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.11.03), and neither is any other CVE in the bulletin.