Google's November 2026 Android bulletin carries a critical remote code execution flaw in the Framework component that needs nothing from the user: no link, no attachment, no permission prompt. It affects Android 14 through 17.

What happened

CVE-2026-58868 is an out-of-bounds write caused by a heap buffer overflow in onOutputReceived of FrameDecoder.cpp. The CVE record states it can lead to remote code execution with no additional execution privileges, and that user interaction is not needed for exploitation. Google's bulletin names it the most severe issue in the release.

The fixes arrive in two patch levels. The 2026-11-01 level covers Android runtime, Framework and System. The 2026-11-05 level adds kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. A device reporting only 2026-11-01 has the Framework fix but not the chipset fixes. Google has not flagged any of the November issues as exploited in the wild.

Who is affected

Android 14, 15, 16, 16 QPR2 and 17 devices that have not taken the November patch level. Delivery depends on the handset maker and the carrier, not on Google.

• Staff phones and tablets on Android 14 or newer with corporate mail, Teams or file sync on them.
• Devices from makers with slow update records, and any handset past its promised support window.
• Ruggedised and field devices running Android, which are usually the last to be updated and the first to hold operational data.

What to do now

Check the security patch level on every Android device in the business, and treat 2026-11-05 as the target, not 2026-11-01.

• Settings, About phone, Android version, then read the Android security update line. Record it per device.
• Push the November update where the maker has released it; Pixel and most enterprise-managed fleets have it now.
• For devices that will not receive it, restrict what they can reach: no corporate mail without an enrolled management profile, and no access to file shares holding client data.
• Do not rely on Google Play system updates to cover this one; the Framework fix ships with the platform patch level.

What this means for South African businesses

Android patching in this market is a procurement problem more than a technical one: cheap handsets with short support windows end up holding mailboxes that were never designed for them. Because there is no known exploitation yet, the honest read is that this is a window to close rather than an incident to respond to, and the businesses that close it are the ones that already know their device inventory. If you cannot produce that list today, that gap is the finding.

Source: Android Security Bulletin for November 2026.

Also on the blog

• ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix
• Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.