Google patches critical Android RCE flaws allowing remote code execution
November 2026 Android Security Bulletin addresses critical RCE vulnerabilities in Android 14-17 without user interaction.
90
Vulnerability1 · 1 read
CVE-2026-55275
Use-after-free in Android from race condition
- CVSS 3.1
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The vulnerability is a use-after-free caused by a race condition in multiple locations of Android. It allows remote escalation of privilege without additional execution privileges or user interaction. An attacker can trigger this remotely to gain higher privileges on affected devices.
What to do: Apply Android's update for CVE-2026-55275. No workaround provided.
Description · NVD
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H