Google’s November Android Security Bulletin fixes 216 vulnerabilities, including three critical flaws that allow remote code execution with no user interaction on Android 14 through 17. Google reports no exploitation in the wild, and none of the issues is marked as under limited, targeted exploitation.
CVE-2026-58868 Heap Overflow Leads the Critical Bugs
The most severe issue is CVE-2026-58868, a heap buffer overflow in FrameDecoder.cpp in the Framework component. It allows remote code execution with no user interaction and no extra privileges. Twenty-two other critical bugs affect the System component, the kernel and chipset components.
The bulletin covers Android 14 through 17 and components from Qualcomm, MediaTek, Arm and Unisoc. Patch level 2026-11-05 covers every issue, and the fixes are spread across two patch levels.
Zero-Click Flaws in libpng and Media Codecs
Three critical bugs allow zero-click remote code execution on Android 14 through 17. Two of them are named in the bulletin: CVE-2026-58936, a use-after-free in libpng’s png_set_tRNS function, and CVE-2026-58876, a use-after-free in Media Codecs that is delivered through Google Play system updates. A crafted media file or image could be enough to run code on an unpatched phone.
CVE-2026-55275 and Other System Privilege Escalation Bugs
The bulletin also lists critical escalation-of-privilege flaws in System: CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984. CVE-2026-55275 affects Android 16 and later and is described as a remote escalation.
Google Reports No Exploitation of the November Android Flaws
Google reports no exploitation in the wild, and a public proof-of-concept exploit has not been confirmed. Source patches for the Android Open Source Project are due within 48 hours of the bulletin, after which custom ROM maintainers and device makers can begin incorporating them.
Google Play System Updates Deliver Some Android Fixes Faster
Delivery depends on the type of fix. Several Media Codecs, MediaProvider, WiFi and Telephony fixes arrive through Google Play system updates, which Google can push without waiting for a device maker’s full firmware release. Others require the manufacturer’s monthly update. Users should confirm that their device reports patch level 2026-11-05 or later once the update becomes available from their maker.
Why libpng and Media Codecs Bugs Keep Ranking Critical
Two of the three zero-click flaws sit in code that handles images and media. Media parsers process data from messages, web pages and files that arrive automatically, so a bug there needs no tap from the user. This is the reason the bulletin classes them as critical even without a report of attacks.
The scale of the bulletin, 216 fixes across two patch levels, reflects both the breadth of the Android ecosystem and the number of third-party chipset components that Google tracks in the same document. Vendor-specific flaws in Qualcomm, MediaTek, Arm and Unisoc code are listed alongside Google’s own, but the fixes for those depend on each chipset vendor and handset maker passing them along.
The split between patch levels also affects timing. Devices that receive only the first-level update will not be fully covered until the later one lands, so the date shown in settings does not by itself tell a user whether all the critical issues are closed. The absence of known exploitation gives most users time, but a zero-click remote code execution bug with a clear location in the code is the kind attackers study once patches become public, and the 48-hour AOSP release makes the changes visible.
Qualcomm, MediaTek, Arm and Unisoc Components in the Bulletin
The affected list reaches beyond Google’s own code to Qualcomm, MediaTek, Arm and Unisoc components. That breadth matters for timing, because the same bulletin entry can reach different phones at different dates depending on which chipset vendor and handset maker sits in the chain.
