NewsCompaniesFlawsGuides
Get the app

Android's November update fixes a critical flaw that needs no tap; check your patch level

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Google's November 2026 Android security bulletin, published on 2 November, rates CVE-2026-58868 Critical. It is a remote code execution flaw in the Android framework affecting Android 14, 15, 16 and 17. The bulletin says exploiting it needs no extra privileges and no user interaction. It does not say whether any flaw in the bulletin is being exploited, and Google lists a security patch level of 2026-11-05 or later as covering every issue in it. When each phone gets the update depends on its maker and carrier, so older or cheaper phones may wait or never receive it.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

Timeline

  1. HARD publishes its alert, at High.

What to do

  1. Open Settings > Security & privacy > System & updates (on some phones About phone > Android version) and install any update offered.
  2. Check that the Android security update date is 5 November 2026 or later.
  3. Do the same on parents' phones.
  4. If a phone no longer receives updates, replace it, and avoid banking or work logins on it meanwhile.
  • CVE-2026-58868 Not on CISA’s list of flaws being used in attacks. Look it up in Search.
  • Google every Google flaw being used in attacks
  • Android every Android flaw being used in attacks

References

  1. Android Open Source Project (). “Android Security Bulletin: November 2026”.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.