Google Issues Patches for Critical Android Flaw Allowing Remote Code Execution

Quick answers

What happened?

Google has released security updates to address a critical vulnerability in the Android operating system. Tracked as CVE-2026-58868, the flaw could allow a remote attacker to execute code on affected devices without any user interaction. The vulnerability impacts Android versions 14 through 17. Patches are available with the November 2026 security patch level, but deployment timelines vary across device manufacturers and mobile carriers worldwide.

Which products are affected?

Android

What should defenders do?

Users and organizations should update affected Android devices to the latest security patch level available from their device manufacturer or carrier. The minimum required patch level is 2026-11-01. It is recommended to check system settings for system updates regularly. Organizations should coordinate with device vendors and IT teams to ensure timely deployment of patches across fleets of Android devices. Until patches are applied, users should exercise caution when connecting to untrusted networks and avoid downloading applications from unverified sources.

Which vulnerabilities are involved?

CVE-2026-58868