Android November bulletin fixes a zero-click Framework flaw

Android November bulletin fixes a zero-click Framework flaw

2 November 2026: Google's Android Security Bulletin for November fixes a critical remote code execution flaw in the Framework component, CVE-2026-58868, that needs no extra privileges and no action from the user, along with a critical denial-of-service flaw, CVE-2026-58882, that lets a crafted SMS disrupt phone calls. Devices on security patch level 2026-11-05 or later are protected against everything in the bulletin; Google gives no sign that any of the flaws has been exploited.

Not yet independently verified. Google does not say whether any of the flaws has been exploited; the public proof of concept for the SMS flaw is reported by Italy's ACN and iThome, not by Google. Counts of the bulletin's fixes differ between sources, so we name only the critical ones. We will update this when it can be confirmed, and remove this note.

The two flaws that matter most for fleets

CVE-2026-58868 is the one Google ranks highest. It is fixed in Android 14, 15, 16, 16 QPR2 and 17, and Google's wording, remote code execution with no user interaction, is the class that attackers prize because nothing has to be tapped or installed.

CVE-2026-58882 affects the same versions. The researcher who reported it, Mark Blaszczyk, has called it an "SMS of Death": a crafted WAP Push message, which the phone processes on arrival, can interfere with calls without any click. Italy's national cybersecurity agency ACN says a proof of concept is public, pointing to the WapPushOverSms component, and iThome reports that the researcher says the flaw reaches back to Android 12, which is older than the oldest version Google lists as fixed. For phones used by field staff, drivers or on-call engineers, a call that cannot be made matters more than its "denial of service" label suggests.

Two patch levels, many vendors

As usual the bulletin has two levels:

• 2026-11-01 covers the Framework and System fixes, including both flaws above and further critical rows: remote code execution in CVE-2026-58876 and CVE-2026-58936, privilege escalation in CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984, and denial of service in CVE-2026-58814;
• 2026-11-05 adds kernel fixes, several of them critical privilege escalations, and components from Arm, Imagination, MediaTek, Unisoc and Qualcomm, including critical MediaTek modem flaws.

Google says it notified partners at least a month before publication and will add the AOSP source links within 48 hours.

Getting the level onto managed phones

Each manufacturer ships its own build on its own timetable, so the bulletin date is not the date a given phone is protected. Mobile device management policies that enforce a minimum security patch level are the practical control: raising the floor to 2026-11-01 covers both headline flaws, and 2026-11-05 covers the chipset fixes as well. Devices that no longer receive security updates will not get either fix and are the ones to retire first.

Related on TrustList:

• Google opens Registered App Stores for Android on 1 December
• Apple backports fix for possibly exploited CoreGraphics bug to iOS 18
• From ten blue links to answer engines: how the role of search engines is changing

Sources

• Android Security Bulletin, November 2026, 2 November 2026
• ACN (Italy's national cybersecurity agency): security updates for Android devices (Italian), 3 November 2026
• iThome: Android SMS of Death flaw CVE-2026-58882 (Chinese), 3 November 2026