Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

Google's November security bulletin discloses a critical Android vulnerability, CVE-2026-58868, that could let an attacker execute code remotely with zero user interaction. It affects Android versions 14 through 17 and stems from a heap buffer overflow causing an out-of-bounds write in the onOutputReceived function inside FrameDecoder.cpp; neither Google nor the CVE record explains how an attacker would trigger it. Devices are protected once they receive security patch level 2026-11-01 or later, though the rollout timing depends on individual manufacturers and carriers, and no active exploitation has been reported so far. The same bulletin also patches another critical bug, CVE-2026-58882, a remote denial-of-service flaw in the decodeWapPdu function that handles WAP Push SMS messages—potentially linked to a publicly disclosed 'SMS of Death' crash bug that can kill phone calls, including emergency calls, and is notably left unpatched on Android 12 and 13. In total, the update addresses 216 vulnerabilities, 23 of them critical, including additional RCE bugs (CVE-2026-58876, CVE-2026-58936) and several critical kernel and chipset-level flaws from MediaTek and Qualcomm.