A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin.
The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.
As of November 4, Google’s bulletin did not report
Source: The Hacker News · 2026-11-04