1. Executive summary
Google's November 2026 Android security bulletin fixes CVE-2026-58868, a critical remote code execution flaw that affects Android 14 through 17 and can be triggered remotely without user interaction. The fix ships with security patch level 2026-11-01 or later, which device makers and carriers distribute on their own schedules, so the exposure window for any given handset depends on the OEM and mobile operator rather than on Google. NVD has not scored the CVE and it is not in CISA KEV, with EPSS at 0%. For EMEA financial services the risk sits with staff and contractor handsets running banking, authenticator and email clients, and with any customer-facing app whose threat model assumes a patched OS; the flaw is critical by Google's rating but there is no public evidence of exploitation.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | The fix reaches handsets only through device makers and carriers on their own schedules, so patch state is a third-party dependency the firm does not control | Firms relying on mobile devices for business processes need the OEM and carrier patch cadence documented in third-party risk records and monitored, not assumed |
| NIS2 Art. 21(2)(d): supply chain security measures | The same OEM and carrier distribution chain sits between Google's fix and the device | Entities in scope must treat the mobile device supply chain as a security dependency and set expectations for patch delivery |
3. Technical analysis & attack chain
The confirmed facts are short. CVE-2026-58868 is a critical Android vulnerability that allows an attacker to run code on a phone remotely without any user action, per Google's November security bulletin. It affects Android 14 through 17. The fix is delivered with security patch level 2026-11-01 or later. As of November 4, Google's bulletin did not report exploitation, and the CVE is not in CISA KEV.
- An attacker reaches the vulnerable Android component remotely. The bulletin does not name the component, the protocol or the interface.
- No user interaction is required, so the victim does not need to open a file, tap a link or install an app.
- Code executes on the device. The bulletin does not state the execution context (app, system service or kernel) or the privileges obtained.
- The device is remediated only when the OEM or carrier ships a build at security patch level 2026-11-01 or later.
What the sources do not give: the vulnerable component, the attack vector in protocol terms, whether exploitation requires adjacency or works over the internet, the privileges gained, any post-exploitation capability, and any observed in-the-wild activity. The primary report was truncated mid-sentence at "Google's bulletin did not report", so the exploitation status is stated only as of November 4 and should be re-checked against the bulletin directly.
NVD has not scored CVE-2026-58868, so no CVSS vector is available; the "critical" rating is Google's own. EPSS is 0%, which reflects the absence of exploitation data rather than a judgement that the flaw is unexploitable.
The ANSSI CERT-FR advisory of 3 November 2026 covers the same November Android bulletin and lists a large set of CVEs fixed in it, including CVE-2025-0647, CVE-2025-22424, CVE-2026-0053 and CVE-2026-20519 through CVE-2026-20562 among others. CVE-2026-58868 is not named in the portion of that advisory available here, and none of the listed CVEs carries a verified score in this advisory. CERT-FR's summary describes remote arbitrary code execution, privilege escalation and data confidentiality impact across the set, without attributing any of those properties to a specific CVE. Treat the CERT-FR list as the wider November patch set, not as detail on CVE-2026-58868.
The Chrome items in the related material (CVE-2026-85046, CVE-2026-87491, the October Chrome release) are separate Google products and separate events. They contribute nothing to this advisory.
No actor is named by any source for CVE-2026-58868. There is no attribution to make.
4. Mitigation & containment
P1 (within 24h)
- Establish the current security patch level across managed Android handsets and record which are below 2026-11-01. On Android this is visible under Settings > About phone > Android version; MDM platforms report it as a device attribute.
- Ask each OEM and carrier in your estate for the date they will ship a build at security patch level 2026-11-01 or later for the models you issue. Record the answers; they are the input to the Art. 28 and Art. 21(2)(d) records in §2.
- For handsets that carry high-value access (banking apps, authenticators, email, MDM admin), restrict use until patched where policy allows, or move the user to a patched device.
P2 (within 72h)
- Re-check Google's November bulletin for an exploitation statement. The primary report records only that none was reported as of November 4.
- Where the estate includes personally owned devices under BYOD, require patch level 2026-11-01 or later as a condition of access to corporate mail and apps, enforced through the MDM compliance policy.
P3 (within 7 days)
- Add patch level 2026-11-01 to the standard build baseline for Android devices and to procurement requirements for new handsets.
- Review whether any customer-facing Android app or internal mobile workflow assumes an unpatched OS, and note the dependency.
No fixed build number, bulletin identifier beyond the patch level, or workaround is named in public reporting for CVE-2026-58868. The only remediation stated is security patch level 2026-11-01 or later.
5. Indicators of compromise
No indicators of compromise available in the source material.
No atomic indicators (hashes, domains, IPs, file paths) are given for CVE-2026-58868 in any source. The observable fact is the device patch level, which is a posture attribute rather than an indicator.
6. Detection
Insufficient indicators to author detection rules.
The sources give no strings, paths, commands or behavioural artefacts specific to CVE-2026-58868. The only usable control signal is the device security patch level, which is an inventory and compliance query rather than a detection rule.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-58868 | — | — | 0% | In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead… |
7. Sources
- The Hacker News, "Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction", https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html, 2026-11-04
- ANSSI CERT-FR, "Multiples vulnérabilités dans Google Android" (CERTFR-2026-AVI-1443), https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1443/, 2026-11-03
- Google Android Security Bulletin, November 2026, https://source.android.com/docs/security/bulletin/2026/2026-11-01
8. Adverse Trace position
Adverse Trace assesses CVE-2026-58868 as a critical-severity remote code execution flaw by Google's rating, with no NVD score, no CISA KEV entry and EPSS at 0%, and no public evidence of exploitation. The client impact for EMEA financial services is moderate and indirect: the flaw is serious, but the practical exposure is governed by OEM and carrier patch delivery, which firms can measure and pressure but not control. The absence of a named component, vector or exploitation report limits what detection and threat hunting can do, and we will not invent indicators to fill that gap. We will re-check the November bulletin for an exploitation statement and for the affected component, and will update this advisory if either appears. Clients should treat patch level 2026-11-01 as the compliance line for Android handsets and record OEM and carrier delivery commitments against DORA Art. 28 and NIS2 Art. 21(2)(d).
Published via PulseTrace — Adverse Trace threat intelligence.