1. Executive summary
CERT-FR published advisory CERTFR-2026-AVI-1443 on 3 November 2026 covering multiple vulnerabilities in Google Android, stating that some allow an attacker to achieve remote arbitrary code execution, privilege escalation and a breach of data confidentiality. The affected population is every Android device without the 1 November 2026 security patch level. The advisory lists more than 60 CVE references but gives no per-CVE technical detail, no affected or fixed version breakdown and no exploitation status; the technical specifics sit in Google's November 2026 Android Security Bulletin, which the CERT-FR advisory points to. Of the ten CVEs with verified scoring, the highest is CVE-2025-22436 at CVSS 8.4 HIGH, and none of the ten is in CISA KEV, with EPSS at 0% for all of them. For EMEA financial services the exposure is concentrated in mobile banking and corporate-managed Android fleets, where patch delivery depends on device OEMs and carriers rather than on the bank.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This is a vendor patch cycle covering more than 60 CVEs. CERT-FR gives the risk categories (remote arbitrary code execution, privilege escalation, data confidentiality impact, denial of service, and one risk marked "non spécifié par l'éditeur") and the affected population (all Android versions without the 1 November 2026 security patch), but no per-CVE mechanism. The triage table below covers the ten CVEs with verified scoring, ordered by CVSS. The remaining CVEs in the CERT-FR list have no verified score in the data available to this advisory and are not individually assessed here.
| CVE | Component | CVSS | KEV / EPSS | Why it matters |
|---|---|---|---|---|
| CVE-2025-22436 | Not stated in CERT-FR advisory | 8.4 HIGH | Not in KEV / 0% | Highest verified score in the set; CWE-451 |
| CVE-2026-0053 | Not stated in CERT-FR advisory | 8.4 HIGH | Not in KEV / 0% | Improper access control (CWE-284) |
| CVE-2025-0647 | Not stated in CERT-FR advisory | 7.9 HIGH | Not in KEV / 0% | CWE-226 |
| CVE-2025-22424 | Not stated in CERT-FR advisory | 7.8 HIGH | Not in KEV / 0% | Improper input validation (CWE-20) |
| CVE-2025-22426 | Not stated in CERT-FR advisory | 7.8 HIGH | Not in KEV / 0% | Improper access control (CWE-284) |
| CVE-2025-38627 | Not stated in CERT-FR advisory | 7.8 HIGH | Not in KEV / 0% | Use after free (CWE-416) |
| CVE-2025-22442 | Not stated in CERT-FR advisory | 7.0 HIGH | Not in KEV / 0% | Race condition (CWE-362) |
| CVE-2025-48600 | Not stated in CERT-FR advisory | 5.5 MEDIUM | Not in KEV / 0% | Missing authorization (CWE-862) |
| CVE-2026-11891 | Not stated in CERT-FR advisory | 5.1 MEDIUM | Not in KEV / 0% | Use after free (CWE-416) |
| CVE-2025-26433 | Not stated in CERT-FR advisory | unknown | Not in KEV / 0% | No CVSS recorded |
The three most urgent entries, with the mechanism detail the sources support:
- CVE-2025-22436 (CVSS 8.4 HIGH, CWE-451). CERT-FR lists it among the flaws behind the advisory's remote code execution and confidentiality risks. No component, attack vector or proof-of-concept detail is given in the CERT-FR advisory.
- CVE-2026-0053 (CVSS 8.4 HIGH, CWE-284). An improper access control flaw. CERT-FR does not state which Android component it sits in or whether it is reachable remotely or only locally.
- CVE-2025-0647 (CVSS 7.9 HIGH, CWE-226). CERT-FR does not describe the mechanism. The CWE classification points to a resource-lifetime issue, but the advisory does not confirm how it is triggered.
The remaining seven scored CVEs (CVE-2025-22424, CVE-2025-22426, CVE-2025-38627, CVE-2025-22442, CVE-2025-48600, CVE-2026-11891, CVE-2025-26433) are covered by their table rows only. CERT-FR does not attribute any of them to a component, an attack vector or an actor.
A separate report from The Hacker News describes CVE-2026-58868 as a critical Android flaw allowing remote code execution without user interaction, affecting Android 14 through 17 and fixed with security patch level 2026-11-01 or later. CVE-2026-58868 appears in the CERT-FR CVE list for this bulletin. The Hacker News report is single-sourced for the "without user interaction" and "Android 14 through 17" claims; CERT-FR does not repeat them. The same report states that as of 4 November Google's bulletin did not report [exploitation status], and the sentence is truncated in the source, so no exploitation claim can be carried from it.
No initial access vector, no malware capability, no persistence mechanism, no command-and-control and no observed victim are described in any source for this bulletin. CERT-FR does not state that any of these vulnerabilities has been exploited in the wild, and none of the ten scored CVEs is in CISA KEV. EPSS is 0% for all ten, which reflects absence of observed exploitation activity rather than proof that exploitation is impossible.
The related CERT-FR advisories of 10 September 2026 (CERTFR-2026-AVI-1158) and 6 October 2026 (CERTFR-2026-AVI-1265) cover earlier Android patch cycles and different CVE sets. They are separate events and contribute no facts to this advisory beyond confirming that CERT-FR issues a monthly Android bulletin. The BSI WID advisories in the related material describe Android and Pixel/Nexus patch cycles without dates tying them to this bulletin; they are not used as a source of facts here.
4. Mitigation & containment
P1 (within 24h)
- Identify every Android device in the estate, corporate-managed and BYOD enrolled in MDM, whose reported security patch level is below 2026-11-01. CERT-FR names the 1 November 2026 patch as the fix boundary.
- For devices that cannot reach 2026-11-01, apply the compensating control the platform supports: restrict installation of apps from unknown sources, enforce Play Protect, and for high-privilege users move banking and email access to a managed profile with a stricter app allowlist.
- Confirm with each OEM and carrier in the fleet when the 2026-11-01 patch will be pushed. Google's bulletin states that phone makers and carriers send the fix on their own schedules (The Hacker News, single-sourced for that wording).
P2 (within 72h)
- Pull the Google Android Security Bulletin for 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01) and map each CVE in the CERT-FR list to its component and severity. The CERT-FR advisory does not provide that mapping, so the bulletin is the only source for it.
- Prioritise remediation of CVE-2025-22436, CVE-2026-0053 and CVE-2025-0647 (CVSS 8.4, 8.4 and 7.9 HIGH) on any device that handles payment initiation, customer authentication or holds customer data.
- Where the bulletin identifies a fix at the Google Play system update layer rather than the full OS patch, push that update through MDM separately; CERT-FR does not distinguish the two layers.
P3 (within 7 days)
- Add a standing monthly control: report the count of managed Android devices below the current patch level to the mobile platform owner, with the OEM and carrier patch timelines recorded.
- Re-check CISA KEV and EPSS for the ten scored CVEs. None is in KEV and all are at 0% EPSS as of this advisory; a change in either is the trigger to escalate.
No fixed release is named in the CERT-FR advisory beyond the 1 November 2026 patch level. No workaround is named by CERT-FR. No exploitation in the wild is reported, so no emergency block or indicator-based containment applies.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
10 referenced CVEs
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2025-22436 | 8.4 High | — | 0% | In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay at… |
| CVE-2026-0053 | 8.4 High | — | 0% | In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insuffici… |
| CVE-2025-0647 | 7.9 High | — | 0% | In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is… |
| CVE-2025-22424 | 7.8 High | — | 0% | In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead… |
| CVE-2025-22426 | 7.8 High | — | 0% | In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in t… |
| CVE-2025-38627 | 7.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_di… |
| CVE-2025-22442 | 7.0 High | — | 0% | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a n… |
| CVE-2025-48600 | 5.5 Medium | — | 0% | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lea… |
| CVE-2026-11891 | 5.1 Medium | — | 0% | Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver all… |
| CVE-2025-26433 | — | — | 0% | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.… |
7. Sources
- ANSSI France CERT-FR, "Multiples vulnérabilités dans Google Android (03 novembre 2026)", https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1443/, 2026-11-03
- Google, "Android Security Bulletin, November 2026", https://source.android.com/docs/security/bulletin/2026/2026-11-01
- The Hacker News, "Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction", https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html
- ANSSI France CERT-FR, "Multiples vulnérabilités dans Google Android (10 septembre 2026)", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1158/ (separate earlier patch cycle)
- ANSSI France CERT-FR, "Multiples vulnérabilités dans Google Android (06 octobre 2026)", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1265/ (separate earlier patch cycle)
8. Adverse Trace position
Adverse Trace assesses this as a high-severity patch cycle with no evidence of exploitation: the highest verified score is CVSS 8.4 HIGH (CVE-2025-22436 and CVE-2026-0053), none of the ten scored CVEs is in CISA KEV, and EPSS is 0% across the set. The client risk is not a live intrusion; it is the patch-latency gap between Google's 1 November 2026 bulletin and the OEM and carrier rollout, which for a retail banking customer base can run to weeks. The CVE-2026-58868 "no user interaction" claim rests on a single news report and should be treated as unconfirmed until Google's bulletin states it directly. We will re-check CISA KEV and EPSS for the ten scored CVEs daily for the next 14 days, pull the component mapping from the Google November bulletin and circulate it to clients running managed Android fleets, and issue an update if any CVE in this bulletin enters KEV or if Google reports exploitation.
Published via PulseTrace — Adverse Trace threat intelligence.