Vulnerability

CVE-2026-58868

9.8CVSS base score · critical (NVD)

0.4%Chance of exploitation in the next 30 days (FIRST EPSS)

Not in KEVNo confirmed exploitation in CISA's catalog yet

What is it?

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Official description from NVD.

What happened

Google released a critical security patch for CVE-2026-58868, an Android vulnerability allowing unauthenticated remote code execution without user interaction. The flaw affects Android 14 through 17. Devices receiving security patch level 2026-11-01 or later are protected, though rollout depends on individual phone manufacturers and carriers. Users should update immediately when available.

From the Intel60 brief of Nov 4, 2026. AI-written summary: check the sources before acting.

Intel60 briefs

CriticalGoogle patches critical Android RCE flaw affecting versions 14-17Nov 4, 2026

Official records

NVDScores, affected versions and references
CVE.orgThe official CVE record