Google's November Android update fixes a critical flaw that could let an attacker run code on a phone with no action from the owner. Here is how to check yours.
Google has patched a critical Android flaw that could let an attacker take over a phone from a distance without the owner tapping or opening anything. It is tracked as CVE-2026-58868 and affects Android 14 through 17. The fix is in Google's November security bulletin, but each phone maker and carrier decides when to send it, so some phones will wait.
Security experts call this kind of bug remote code execution, meaning an attacker could run their own commands on your phone from afar. The cause is a memory mistake in a piece of Android code called FrameDecoder.cpp. In plain terms, a program writes data past the space set aside for it. Neither the bulletin nor the flaw's public record says how an attacker would reach that code.
There is some reassurance. As of November 4, Google's bulletin did not report any attacks using its flaws. None was in the U.S. government's catalog of known exploited flaws as of its November 3 update. Google's Critical label also assumes Android's built-in protections are turned off or bypassed.
Phones running Android 14 through 17 are affected by this flaw. Android 12 and 13 are not listed for it, though Google's records do not say whether those versions contain it. Owners of those older phones should not assume they are safe from everything in the bulletin, as the next section explains.
The bulletin lists 216 flaws, 23 of them rated Critical. Two more Critical flaws, CVE-2026-58876 and CVE-2026-58936, could also allow remote code execution. Six Critical flaws are in the kernel, the core of the system, and two of those are in Bluetooth code. Other Critical fixes cover MediaTek modem code and a Qualcomm component. MediaTek says it knows of no active exploitation of its flaws.
One more Critical flaw, CVE-2026-58882, could let an attacker crash a phone remotely through a text-based message type called WAP Push. A researcher known as Mark B published a write-up on October 29 about a bug in the same code. It says one malformed message can crash the phone's calling software and end any call, including emergency calls. A test app is public. The researcher says Android 12 and 13 run the same code but get no fix. It is not confirmed that this is the same bug.
The alert box above lists the steps. The key detail is the date. A security patch level of 2026-11-01 covers CVE-2026-58868. A level of 2026-11-05 covers every fix in the bulletin, including kernel and chip-maker parts. Some phones also get fixes through Google Play system updates, but CVE-2026-58868 is not among them, so the main Android update is the one that counts.
The bulletin offers no workaround for phones that cannot update yet, so waiting for the maker or carrier is the only route. Still unknown is how an attacker would trigger the main flaw and whether anyone will try. Watch for an update prompt in the coming days.
Check your Android security update date, install any update offered, and aim for a patch level of 2026-11-05 or later.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
