Google patches critical Android RCE flaws allowing remote code execution
November 2026 Android Security Bulletin addresses critical RCE vulnerabilities in Android 14-17 without user interaction.
90
Vulnerability1 · 1 read
CVE-2026-58876
Use-after-free RCE in Android
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
This is a use-after-free memory safety issue in multiple locations of Android. Remote code execution is possible without user interaction or additional privileges. It affects Android users, potentially allowing attackers to gain full control.
What to do: Apply Google's update for CVE-2026-58876.
| Product | Affected |
|---|---|
| Google Android | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
In the news
2 storiesGoogle Patches Over 200 Android Vulnerabilities Including Critical Zero-Click RCE Flaws
The November 2026 Android security update addresses more than 200 vulnerabilities, including critical remote code execution flaws that require no user interaction.
90