Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)

Key facts for Android Nov 2026 bulletin

Detection coverage for Android Nov 2026 bulletin

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5206 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Android Devices Exposed To CVE-2026-58868 FrameDecoder RCE (Patch Level Below 2026-11-05)

Inventory-based exposure detection for TL-2026-5206 (Android Security Bulletin November 2026). Flags managed Android 14-17 devices whose security patch level is below 2026-11-01 (exposed to the critical zero-click Framework heap overflow CVE-2026-58868 in FrameDecoder.cpp onOutputReceived, A-486464711) or below 2026-11-05 (Kernel, MediaTek modem and Qualcomm fixes missing, incl. kernel CVE-2026-53256). No in-the-wild exploitation is reported, so this is a posture/exposure rule, not an exploit-activity rule.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1664, T1203, T1404
• Data sources: intune:manageddevice (Microsoft Graph managedDevice), IntuneDevices
• Severity: high
• Confidence: high

Splunk SPL

index=mdm sourcetype="intune:manageddevice" earliest=-7d operatingSystem="Android" osVersion IN ("14*","15*","16*","17*") | where androidSecurityPatchLevel < "2026-11-05" | eval exposure=if(androidSecurityPatchLevel < "2026-11-01", "CVE-2026-58868 FrameDecoder RCE unpatched (TL-2026-5206)", "2026-11-05 kernel/vendor fixes missing (TL-2026-5206)") | stats latest(androidSecurityPatchLevel) as patch_level latest(osVersion) as os_version latest(exposure) as exposure latest(complianceState) as compliance latest(lastSyncDateTime) as last_sync by deviceName userPrincipalName | sort 0 patch_level

Microsoft KQL

IntuneDevices | where TimeGenerated > ago(7d) | where OS =~ 'Android' | where OSVersion matches regex @'^(14|15|16|17)([.]|$)' | summarize arg_max(TimeGenerated, *) by DeviceId | project DeviceName, UPN, OS, OSVersion, ComplianceState, LastContact | order by LastContact desc

Sigma

title: Android Device Missing November 2026 Security Patch Level (CVE-2026-58868)
id: a1c4e2d0-5b6f-4c1e-9a3d-7f2b8e5c1a01
status: experimental
description: Managed Android 14-17 device reporting a security patch level older than 2026-11-05, leaving it exposed to CVE-2026-58868 (FrameDecoder.cpp zero-click RCE) and the 2026-11-05 kernel/vendor critical fixes. Exposure rule; no exploitation is reported.
references:
    - https://source.android.com/docs/security/bulletin/2026/2026-11-01
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58868
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.initial-access
    - attack.t1664
    - attack.execution
    - attack.t1203
    - attack.privilege-escalation
    - attack.t1404
    - cve.2026.58868
logsource:
    product: intune
    service: manageddevice
detection:
    selection_os:
        operatingSystem: 'Android'
        osVersion|re: '^(14|15|16|17)([.]|$)'
    selection_patch:
        androidSecurityPatchLevel|re: '^(20(0|1)[0-9]|202[0-5]|2026-(0[0-9]|10)|2026-11-0[1-4])'
    condition: selection_os and selection_patch
falsepositives:
    - Devices awaiting OEM or carrier rollout of the 2026-11-05 level
    - Test or lab devices intentionally held back
level: high

Known false positives:

• Devices awaiting OEM or carrier rollout of the 2026-11-05 patch level
• Lab or test devices intentionally held back on older builds

Tuning notes: Index and sourcetype names (mdm / intune:manageddevice) are environment-specific; adjust to where Graph managedDevice data lands. The comparison uses ISO date strings, which sort lexicographically. Raise the threshold to 2026-11-01 only if kernel/vendor components are out of scope. The KQL flavor cannot filter on patch level because IntuneDevices does not carry it; it scopes the Android 14-17 population, so enrich from a Graph-sourced table if available. Add an OEM-delay exclusion list and a grace period of several days after bulletin publication (2026-11-02).

• 🔒 Successful Sign-ins From Non-Compliant Android Devices (Unpatched Exposure) · unlock with TL Creds
• 🔒 Android Device Newly Reporting Root Or Jailbreak State · unlock with TL Creds
• 🔒 Defender Alerts On Android Devices For Exploitation Or Privilege Escalation · unlock with TL Creds
• 🔒 Android FrameDecoder onOutputReceived Backtrace In Native Crash (CVE-2026-58868) · unlock with TL Creds
• 🔒 Android Media Codec Process Executing A Shell · unlock with TL Creds
• 🔒 Android Media Codec Domain Process Opening Outbound Network Connection · unlock with TL Creds
• 🔒 Android SELinux Denials From Media/App Domains Toward Kernel And Init Targets · unlock with TL Creds
• 🔒 Repeated Native Crashes In Android Bluetooth, HID, WiFi Or Telephony Stack · unlock with TL Creds

Indicators of compromise for Android Nov 2026 bulletin

As of 2026-11-04, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5206.

How Android Nov 2026 bulletin works

Google's Android Security Bulletin for November 2026 ships two security patch levels. The 2026-11-01 level addresses 119 vulnerabilities, concentrated in Framework (65) and System (53), plus one high-severity information disclosure in Android Runtime. The 2026-11-05 level addresses 97 vulnerabilities in the Kernel and in Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Per SecurityWeek, more than two dozen issues are rated critical, and 17 critical flaws were addressed earlier through Google Play system updates. The bulletin page states that devices with Android 10 and later may receive both security updates and Google Play system updates, and that several issues sit in Project Mainline components: Media Codecs, MediaProvider, Profiling, Telephonycore and WiFi. The SecurityWeek figure of 17 critical Play-system-update flaws is reported as stated by that source; it could not be reconciled against the bulletin page.

The most severe issue is CVE-2026-58868, a critical Framework flaw (Android bug reference A-486464711). The NVD description states: 'In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed.' The bulletin states that user interaction is not needed for exploitation. The affected AOSP versions listed are 14, 15, 16, 16-qpr2 and 17. NVD published the record on 2026-11-02 and last modified it on 2026-11-03; it is 'Awaiting Analysis' with no CVSS score or CWE. The attached SSVC assessment records exploitation as none, automatable as yes, and technical impact as total. The CWE values recorded here (CWE-787, CWE-122) are derived from the 'out-of-bounds write / heap buffer overflow' wording only.

Other critical issues listed in the bulletin include System component CVE-2026-58876, CVE-2026-58936, CVE-2026-55275, CVE-2026-55283, CVE-2026-58984, CVE-2026-58814 and CVE-2026-58882; Kernel-area CVE-2026-53256, CVE-2026-59044, CVE-2026-59045, CVE-2026-80604, CVE-2026-89774 and CVE-2026-59048; MediaTek modem CVE-2026-20499, CVE-2026-20519, CVE-2026-20520 and CVE-2026-20545 through CVE-2026-20549; and a Qualcomm closed-source component flaw, CVE-2026-25285. SecurityWeek describes the critical weaknesses at the 2026-11-05 level as being in Bluetooth, pKVM, HID, the MediaTek modem and an unspecified Qualcomm closed-source component. Android XR receives one additional high-severity Framework fix and Wear OS two high-severity fixes (Framework and System).

No source reports in-the-wild exploitation, a public PoC, or attribution to a threat actor. A partial read of the CISA KEV feed (first 100,000 characters of a roughly 1.8M-character document) did not show CVE-2026-58868; that check is incomplete. The MITRE ATT&CK mappings in this record describe the technique classes these bug types would enable if exploited, not observed adversary behavior. There are no network indicators, so no BeaconBeagle correlation was applicable. Defenders should prioritize deploying the 2026-11-05 patch level (which includes the 2026-11-01 fixes), and verify OEM and carrier rollout status for managed fleets.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Privilege Escalation

T1404 Exploitation for Privilege Escalation

Initial Access

T1664 Exploitation for Initial Access

Remediation for Android Nov 2026 bulletin

Patches

• Android Security Bulletin November 2026: patch levels 2026-11-01 and 2026-11-05
• Google Play system updates (Mainline) for Media Codecs, MediaProvider, Profiling, Telephonycore and WiFi components

Immediate actions

• Deploy the 2026-11-05 security patch level (includes 2026-11-01 fixes) to all managed Android devices
• Verify patch level via Settings > About phone > Android security update, or via MDM compliance reporting
• Confirm Google Play system updates (Mainline) are applied on managed devices running Android 10 or later

Workarounds

• No workaround is described in the sources; patching is the only documented mitigation

Longer-term hardening

• Enforce MDM compliance policies that block or quarantine devices more than one patch level behind
• Retire devices that no longer receive Android security updates
• Track OEM and carrier patch rollout SLAs for the 2026-11-05 level

Affected and fixed versions

• Google — Android (AOSP)
  Vulnerable versions: 14; 15; 16; 16-qpr2; 17
  Fixed in: Security patch level 2026-11-01 or later (Framework/System); Security patch level 2026-11-05 or later (Kernel and vendor components)
• Google — Android Project Mainline (Media Codecs, MediaProvider, Profiling, Telephonycore, WiFi)
  Vulnerable versions: Android 10 and later (Play system update eligible)
  Fixed in: November 2026 Google Play system updates
• Google — Android XR / Wear OS
  Vulnerable versions: Versions not stated in source
  Fixed in: November 2026 updates
• MediaTek — Modem firmware
  Vulnerable versions: Versions not stated in source
  Fixed in: 2026-11-05 patch level
• Qualcomm — Closed-source components
  Vulnerable versions: Versions not stated in source
  Fixed in: 2026-11-05 patch level

Timeline of Android Nov 2026 bulletin

• 2026-11-01 Android security patch level 2026-11-01 defined, fixing 119 vulnerabilities (Framework 65, System 53, Android Runtime 1), including critical CVE-2026-58868
• 2026-11-02 NVD publishes CVE-2026-58868 (20:17 UTC): heap buffer overflow in onOutputReceived of locked-ioc-4 enabling remote code execution; affects AOSP 14, 15, 16, 16-qpr2, 17
• 2026-11-02 Android Security Bulletin November 2026 published on source.android.com, naming the Framework flaw (A-486464711) as the most critical issue and noting Mainline components fixed via locked-ioc-7 Play system updates
• 2026-11-03 SecurityWeek reports over 200 vulnerabilities patched, over two dozen critical, 17 critical flaws fixed via locked-ioc-7 Play system updates, and no active exploitation reported
• 2026-11-03 NVD record for CVE-2026-58868 last modified (14:52 UTC); status Awaiting Analysis with SSVC data showing exploitation none, automatable yes, technical impact total; no CVSS score assigned
• 2026-11-04 Partial check of the CISA KEV feed (first 100,000 characters) shows no CVE-2026-58868 entry; the check is incomplete
• 2026-11-05 Android security patch level 2026-11-05 covers 97 vulnerabilities in Kernel, Arm, Imagination Technologies, locked-ioc-5, Unisoc and locked-ioc-6 components, including critical flaws in Bluetooth, pKVM, HID, locked-ioc-5 modem and a locked-ioc-6 closed-source component

Sources cited for Android Nov 2026 bulletin

• NVD: CVE-2026-58868 NVD (NIST) · Advisory · 2026-11-02
• CISA Known Exploited Vulnerabilities catalog (feed) CISA · Government advisory · 2026-11-04
• Android Security Bulletin - November 2026 (2026-11-01) source.android.com · Vendor report · 2026-11-02
• Android Security Bulletins index source.android.com · Vendor report · 2026-11-02
• Android's November 2026 Updates Patch Over 200 Vulnerabilities (SecurityWeek) SecurityWeek · News · 2026-11-03

More in vulnerability

• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)
• Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)
• Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices
• Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets (LND macaroon credential exposure)
• CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root