SlowMist: Android Zero-Click RCE Vulnerability Included in November Security Patch, Users Strongly Advised to Update

November 5 — SlowMist Chief Information Security Officer 23pds posted on X that an Android zero-click remote code execution vulnerability has been included in the November security patch, and users are strongly advised to update. Google's November 2026 bulletin fixed more than 200 vulnerabilities, the most severe being CVE-2026-58868 (Critical) in the Framework layer, which allows remote execution of arbitrary code with no user interaction and no additional permissions, affecting Android 14, 15, 16, 16 QPR2 and 17. There is currently no confirmed exploitation in the wild.

23pds said that versions with a security patch level of 2026-11-01 or later include fixes for CVE-2026-58868 and other Framework/System fixes; versions dated November 5 or later cover all vulnerabilities in this round, including chipset-level fixes for the kernel, MediaTek, Qualcomm and others. Users can check the "Security patch level" under "Settings → About phone → Android version".