Google Patches Critical Android RCE Flaws That Let Attackers Execute Code Without User Interaction

Google released its November 2026 Android Security Bulletin, which addresses critical vulnerabilities that could allow remote code execution without user interaction or additional execution privileges.

Published on November 2, the bulletin highlights a framework vulnerability as the most severe issue and also documents other critical remote code execution flaws in Android’s system components.

According to Google’s November security bulletin, security patch levels of 2026-11-05 or later address all applicable issues. The three critical platform RCE vulnerabilities affect Android 14, 15, 16, 16-QPR2, and 17, making remediation relevant across multiple supported releases.

Critical Android RCE Flaws

The Framework flaw, CVE-2026-58868, carries Android tracking reference A-486464711. Google states that exploitation requires neither user interaction nor additional execution privileges. However, the bulletin does not disclose the underlying programming error, exploit delivery mechanism, or specific vulnerable interface.

The System component contains two additional critical RCE vulnerabilities: CVE-2026-58876 and CVE-2026-58936. Google similarly describes the section’s most severe vulnerability as exploitable without user interaction. These disclosures follow earlier Android zero-click vulnerability coverage, although the November issues have distinct identifiers and remediation requirements.

The following table summarizes all critical Framework and System vulnerabilities, excluding separately listed kernel and chipset issues.

CVE	Component	Type	Severity	Updated AOSP versions
CVE-2026-58868	Framework	RCE	Critical	14, 15, 16, 16-qpr2, 17
CVE-2026-58876	System	RCE	Critical	14, 15, 16, 16-qpr2, 17
CVE-2026-58936	System	RCE	Critical	14, 15, 16, 16-qpr2, 17
CVE-2026-55275	System	Privilege escalation	Critical	16, 16-qpr2, 17
CVE-2026-55283	System	Privilege escalation	Critical	16, 16-qpr2, 17
CVE-2026-58984	System	Privilege escalation	Critical	15, 16, 16-qpr2, 17
CVE-2026-58814	System	Denial of service	Critical	14, 15, 16, 16-qpr2, 17
CVE-2026-58882	System	Denial of service	Critical	14, 15, 16, 16-qpr2, 17

Google’s severity assessment assumes platform and service mitigations are disabled for development or successfully bypassed. Consequently, a critical rating describes potential impact under those conditions; it does not establish that every unpatched device is immediately exploitable through an internet-facing service. The bulletin provides no detailed attack chain for these RCE flaws.

Notably, CVE-2026-58876 also appears under Media Codecs in the Google Play system updates section. This identifies a Project Mainline delivery path for that issue, but does not mean every November vulnerability can be resolved through a Google Play system update alone.

The bulletin also fixes CVE-2026-58988, a high-severity Android runtime information-disclosure vulnerability requiring no additional execution privileges or user interaction. Other sections address kernel, modem, GPU, and vendor-specific weaknesses.

The 2026-11-01 patch level covers the listed Framework and System flaws. The broader 2026-11-05 level adds applicable kernel and vendor fixes while incorporating previous patch requirements. Administrators should distinguish these levels when validating remediation across managed devices.

Google says Android partners receive vulnerability notifications at least one month before publication. Corresponding AOSP source patches are scheduled within 48 hours of the bulletin’s initial release. Users should install available manufacturer updates and verify the resulting security patch level rather than relying solely on their Android version.

Platform hardening and Android Advanced Protection provide additional defensive context, while Google Play Protect monitors potentially harmful applications. Google emphasizes that newer Android protections reduce the likelihood of exploitation and recommends updating to the latest available Android version wherever possible.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.