Android zero-click flaw fixed, but many phones may miss patch

Google has fixed a critical Android security flaw that could allow hackers to take over a phone without the user clicking or approving anything. The most severe bug lies in media-processing code that generates preview images. Nearly half of active Android devices will never receive the patch.

Zero-click flaw in media code

The November 2026 Android Security Bulletin warns of a critical remote code execution vulnerability that hackers can exploit without users noticing anything. The advisory says the most severe issue is a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed and no user interaction. The highlighted flaw affects all supported Android versions 14 through 17. Older end-of-life Android releases may also be vulnerable, because the vulnerable component dates back to 2017. The bug is tracked as CVE-2026-58868 and is described as a heap buffer overflow causing an out-of-bounds write. It lies in Android's framework component responsible for handling media playback, specifically a vulnerable function in FrameDecoder.cpp that creates preview images such as video and photo thumbnails. No public proof-of-concept exploit is currently available, and Google has not confirmed active exploitation in the wild. However, AI-assisted attackers can relatively quickly reverse-engineer patches once source code is publicly released 48 hours after the bulletin's initial publication. All users are advised to update their devices to the latest security patch level of 2026-11-01 or later.

Many devices may miss the patch

Android's distribution data shows that 43.6% of active devices still run Android 13 or older, where security support has ended and new fixes are not received. For newer Android devices, each manufacturer has to build and ship the patch, which can carry a delay. Many budget phones that passed their promised update window might also never get the November patch. Android is the most popular mobile operating system with a user base nearing 4 billion, according to various estimates.

November update fixes 216 flaws

The Android security update addresses 23 critical vulnerabilities and 193 less severe bugs in total. It brings a fix for a critical SMS of Death vulnerability, which enables attackers to crash Android's phone service, drop active calls, including emergency calls, and potentially cause a reboot loop. Two critical severity system vulnerabilities, CVE-2026-58876 and CVE-2026-58936, both rated 9.8 out of 10 on the severity scale, could lead to remote code execution without requiring additional execution privileges or user interaction. Several critical vulnerabilities that enable malicious code to elevate privileges were identified in kernel components. Google also included critical fixes for MediaTek and Qualcomm components.

Sources: Cybernews