Company Android phones: November’s update fixes a flaw that needs no tap. Check every patch level

Google’s November Android bulletin went out on Monday, and its worst entry needs nothing from the phone’s owner. Google rates a Framework flaw critical because it could lead to remote code execution with no tap or click.

Nothing in the bulletin is marked as exploited. The job is the usual monthly one, with a sharper reason to chase the stragglers in your fleet.

The worst Android bug this month needs no tap from the phone’s owner. Check the patch level, not the model.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Android’s November update fixes a no-tap Framework flaw

The Android Security Bulletin for November 2026, published November 2, covers two patch levels. Level 2026-11-01 carries the Android runtime, Framework and System fixes; 2026-11-05 adds kernel and chip-vendor fixes from Arm, Imagination, MediaTek, Unisoc and Qualcomm. Google says devices on 2026-11-05 or later are protected against everything listed.

The most severe is CVE-2026-58868 in Framework, a possible out-of-bounds write in FrameDecoder.cpp, according to its CVE record, rated critical for remote code execution with no user interaction on Android 14, 15, 16 and 17. Two more critical remote code execution bugs sit in System: CVE-2026-58876, a use-after-free, and CVE-2026-58936, a use-after-free in libpng’s png_set_tRNS.

Phones on Android 14 through 17 below the November patch level

Every phone and tablet on Android 14 through 17 below the November patch level is in scope until its maker ships the update. CyberStack counts 208 CVEs in the bulletin, 23 of them critical, including eight MediaTek modem flaws and one Qualcomm flaw at the 2026-11-05 level.

Some fixes reach phones through Google Play system updates instead of the maker’s firmware, including Media Codecs, MediaProvider and Wi-Fi components. CVE-2026-58876 is one of the Media Codecs fixes, so a phone can get it before its maker’s November build lands.

Get handsets to patch level 2026-11-05

• Pull a patch-level report from your MDM and flag every device below 2026-11-05, or below 2026-11-01 if its maker only ships the first level.
• On each phone, check Settings, then Security and privacy, then Updates, for both the security update and the Google Play system update.
• Set a compliance date for staff phones, and list devices whose makers no longer ship monthly updates for replacement.

Details

• CVE-2026-58868: Framework, remote code execution, critical, Android 14, 15, 16, 16 QPR2 and 17; out-of-bounds write in onOutputReceived of FrameDecoder.cpp (CVE record). Fixed at patch level 2026-11-01.
• CVE-2026-58876 and CVE-2026-58936: System, remote code execution, critical, Android 14 to 17. CVE-2026-58936 is a use-after-free in png_set_tRNS of pngset.c.
• Patch levels: 2026-11-01 (runtime, Framework, System) and 2026-11-05 (adds kernel and vendor components). Google says AOSP source patches follow within 48 hours of the November 2 publication.
• Exploitation: the bulletin marks no entry as exploited.

Hunt / verify

• In your MDM, filter on security patch level older than 2026-11-01 and sort by last check-in, so idle devices that skip updates surface first.
• Spot-check a few handsets per maker: Samsung, Motorola and Google publish their own monthly notes and ship on different days.

Source: Android Security Bulletin, November 2026; CyberStack summary

Sources

• Android Security Bulletin, November 2026 (published November 2, 2026)
• CyberStack: Android November 2026 security bulletin, 208 CVEs, 23 critical
• NVD: CVE-2026-58868

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].