Google’s November 2026 Android Security Bulletin classifies CVE-2026-58868 as a Critical remote code execution (RCE) vulnerability in the Framework. It lists Android 14, 15, 16, 16 QPR2, and 17 as affected, and says exploitation requires neither user interaction nor additional execution privileges. Google’s Android Security Bulletin
What the November patch dates mean
Google published the bulletin on November 2, 2026. It lists CVE-2026-58868 in the details for the 2026-11-01 security patch level. Google says patch levels dated 2026-11-05 or later address all issues in the November bulletin.
How to check the patch date on your Android device
On a phone or tablet, open Settings > About phone (or About tablet) > Android version and look for the Android security update date. Menu labels can vary by device. The displayed date is the patch level installed on that handset; Android updates are distributed by device manufacturers and carriers.
What the public proof of concept establishes
Mallory’s analysis describes the public repository it examined as a memory-corruption proof of concept, not a working RCE payload.
