Vulnerability
CVE-2026-58868
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS score–Not scored
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Google patches critical Android flaw that allows remote code execution without user action
Google's November security bulletin describes critical flaw CVE-2026-58868, which could allow remote code execution without user interaction. It affects Android 14 through 17, and devices are fixed with security patch level 2026-11-01 or later, with rollout controlled by device makers and carriers.
Sources: NVD and CISA known exploited vulnerabilities catalogue.