Google patches critical Android RCE flaws allowing remote code execution
November 2026 Android Security Bulletin addresses critical RCE vulnerabilities in Android 14-17 without user interaction.
90
Vulnerability1 · 1 read
CVE-2026-58984
Use-after-free in Android leading to local privilege escalation
- CVSS 3.1
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free memory corruption in multiple Android locations enables local privilege escalation. An attacker with local device access can trigger it without user interaction or extra privileges needed. Full system compromise results, affecting all Android installations.
What to do: Apply Google's update for CVE-2026-58984. No workaround mentioned.
| Product | Affected |
|---|---|
| Google Android | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H