Critical zero-click Android flaw patched in November bulletin

Google's November 2026 Android security bulletin closes 216 vulnerabilities, 23 of them rated Critical. The headline issue is CVE-2026-58868, a flaw that allows remote code execution with no user interaction at all. It stems from a heap buffer overflow in FrameDecoder.cpp, part of the media decoding path, and affects Android versions 14 through 17.

Several other Critical entries sit alongside it. CVE-2026-58882 is a remote denial-of-service condition in the function that parses WAP Push messages delivered over SMS, again requiring no interaction from the user. CVE-2026-58876 and CVE-2026-58936 are both remote code execution flaws in the System component. On the kernel side there are six Critical issues, two of them in Bluetooth code, plus Critical fixes in MediaTek modem and Qualcomm components.

Why it matters

What distinguishes these flaws is that the victim does not have to tap a link or open a file. Delivering a crafted media payload or a specially formatted message to the device can be enough for code to run. Google states that as of the bulletin's publication it has no evidence of these flaws being used in attacks, and none of them appeared in CISA's Known Exploited Vulnerabilities catalogue. Even so, past Android bulletins have shown that the gap between public technical detail and working exploit code tends to be short.

Android ships these fixes across two patch levels. The 2026-11-01 level covers framework and system component flaws, while 2026-11-05 covers the entire bulletin, including kernel and vendor components. Because the Critical modem fixes land in the second group, only 2026-11-05 or later represents full coverage.

What this means for companies

At most small and mid-sized companies in Türkiye, employees' personal phones are connected to corporate email, cloud file storage and frequently the VPN as well. Field teams, logistics and agency operations, and shift supervisors at construction sites and production plants run a meaningful share of daily work from a handset. Most of these devices never appear in any company inventory, their patch status goes untracked, and depending on the manufacturer the update may arrive weeks after Google publishes it. A compromised phone can mean direct access to a corporate mailbox and to live session tokens. Where that correspondence contains personal data, the result is a breach that is notifiable under Türkiye's KVKK regime.

What Kamer Bilişim recommends

• Inventory every device that touches corporate data. List which employee connects to email, file sharing and VPN from which handset. Without that list there is no way to track patch status, and in most companies the inventory simply does not exist.
• Make the patch level a condition of access. If you run Microsoft 365 or Google Workspace, mobile device management policies let you block devices below a given security patch level from connecting to corporate mail. Setting the threshold at 2026-11-05 is a sound starting point.
• Add the vendor's update commitment to your purchasing criteria. Before buying company handsets, confirm in writing how many years of security updates the model will receive. A device whose update support has ended is not suitable for corporate access, whatever the price advantage.

To set up mobile device management policies, make corporate email access conditional, or review your current setup, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: The Hacker News, Security Affairs, Android Security Bulletin (November 2026)