# Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)

> Google's November 2026 Android security updates fix over 200 vulnerabilities across the 2026-11-01 (119 flaws) and 2026-11-05 (97 flaws) patch levels. The most severe, CVE-2026-58868 in Framework (FrameDecoder.cpp heap overflow), allows remote code execution with no extra privileges and no user interaction; no active exploitation is reported.

- **Published:** 2026-11-04T03:27:01Z
- **Last reviewed:** 2026-11-04T03:27:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5206
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5206.png
- **ID:** TL-2026-5206
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-58868, CVE-2026-58876, CVE-2026-58936, CVE-2026-55275, CVE-2026-55283, CVE-2026-58984, CVE-2026-58814, CVE-2026-58882, CVE-2026-53256, CVE-2026-59044, CVE-2026-59045, CVE-2026-80604, CVE-2026-89774, CVE-2026-59048, CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545, CVE-2026-20546, CVE-2026-20547, CVE-2026-20548, CVE-2026-20549, CVE-2026-25285

## Description

Google's Android Security Bulletin for November 2026 ships two security patch levels. The 2026-11-01 level addresses 119 vulnerabilities, concentrated in Framework (65) and System (53), plus one high-severity information disclosure in Android Runtime. The 2026-11-05 level addresses 97 vulnerabilities in the Kernel and in Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Per SecurityWeek, more than two dozen issues are rated critical, and 17 critical flaws were addressed earlier through Google Play system updates. The bulletin page states that devices with Android 10 and later may receive both security updates and Google Play system updates, and that several issues sit in Project Mainline components: Media Codecs, MediaProvider, Profiling, Telephonycore and WiFi. The SecurityWeek figure of 17 critical Play-system-update flaws is reported as stated by that source; it could not be reconciled against the bulletin page.

The most severe issue is CVE-2026-58868, a critical Framework flaw (Android bug reference A-486464711). The NVD description states: 'In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed.' The bulletin states that user interaction is not needed for exploitation. The affected AOSP versions listed are 14, 15, 16, 16-qpr2 and 17. NVD published the record on 2026-11-02 and last modified it on 2026-11-03; it is 'Awaiting Analysis' with no CVSS score or CWE. The attached SSVC assessment records exploitation as none, automatable as yes, and technical impact as total. The CWE values recorded here (CWE-787, CWE-122) are derived from the 'out-of-bounds write / heap buffer overflow' wording only.

Other critical issues listed in the bulletin include System component CVE-2026-58876, CVE-2026-58936, CVE-2026-55275, CVE-2026-55283, CVE-2026-58984, CVE-2026-58814 and CVE-2026-58882; Kernel-area CVE-2026-53256, CVE-2026-59044, CVE-2026-59045, CVE-2026-80604, CVE-2026-89774 and CVE-2026-59048; MediaTek modem CVE-2026-20499, CVE-2026-20519, CVE-2026-20520 and CVE-2026-20545 through CVE-2026-20549; and a Qualcomm closed-source component flaw, CVE-2026-25285. SecurityWeek describes the critical weaknesses at the 2026-11-05 level as being in Bluetooth, pKVM, HID, the MediaTek modem and an unspecified Qualcomm closed-source component. Android XR receives one additional high-severity Framework fix and Wear OS two high-severity fixes (Framework and System).

No source reports in-the-wild exploitation, a public PoC, or attribution to a threat actor. A partial read of the CISA KEV feed (first 100,000 characters of a roughly 1.8M-character document) did not show CVE-2026-58868; that check is incomplete. The MITRE ATT&CK mappings in this record describe the technique classes these bug types would enable if exploited, not observed adversary behavior. There are no network indicators, so no BeaconBeagle correlation was applicable. Defenders should prioritize deploying the 2026-11-05 patch level (which includes the 2026-11-01 fixes), and verify OEM and carrier rollout status for managed fleets.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1203 Exploitation for Client Execution
- T1404 Exploitation for Privilege Escalation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Android Devices Exposed To CVE-2026-58868 FrameDecoder RCE (Patch Level Below 2026-11-05)** (`TL-2026-5206-SPL-001`)

Inventory-based exposure detection for TL-2026-5206 (Android Security Bulletin November 2026). Flags managed Android 14-17 devices whose security patch level is below 2026-11-01 (exposed to the critical zero-click Framework heap overflow CVE-2026-58868 in FrameDecoder.cpp onOutputReceived, A-486464711) or below 2026-11-05 (Kernel, MediaTek modem and Qualcomm fixes missing, incl. kernel CVE-2026-53256). No in-the-wild exploitation is reported, so this is a posture/exposure rule, not an exploit-activity rule.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1664, T1203, T1404
- **Data sources:** intune:manageddevice (Microsoft Graph managedDevice), IntuneDevices
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mdm sourcetype="intune:manageddevice" earliest=-7d operatingSystem="Android" osVersion IN ("14*","15*","16*","17*") | where androidSecurityPatchLevel < "2026-11-05" | eval exposure=if(androidSecurityPatchLevel < "2026-11-01", "CVE-2026-58868 FrameDecoder RCE unpatched (TL-2026-5206)", "2026-11-05 kernel/vendor fixes missing (TL-2026-5206)") | stats latest(androidSecurityPatchLevel) as patch_level latest(osVersion) as os_version latest(exposure) as exposure latest(complianceState) as compliance latest(lastSyncDateTime) as last_sync by deviceName userPrincipalName | sort 0 patch_level
```

### Microsoft KQL

```kql
IntuneDevices | where TimeGenerated > ago(7d) | where OS =~ 'Android' | where OSVersion matches regex @'^(14|15|16|17)([.]|$)' | summarize arg_max(TimeGenerated, *) by DeviceId | project DeviceName, UPN, OS, OSVersion, ComplianceState, LastContact | order by LastContact desc
```

### Sigma

```yaml
title: Android Device Missing November 2026 Security Patch Level (CVE-2026-58868)
id: a1c4e2d0-5b6f-4c1e-9a3d-7f2b8e5c1a01
status: experimental
description: Managed Android 14-17 device reporting a security patch level older than 2026-11-05, leaving it exposed to CVE-2026-58868 (FrameDecoder.cpp zero-click RCE) and the 2026-11-05 kernel/vendor critical fixes. Exposure rule; no exploitation is reported.
references:
    - https://source.android.com/docs/security/bulletin/2026/2026-11-01
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58868
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.initial-access
    - attack.t1664
    - attack.execution
    - attack.t1203
    - attack.privilege-escalation
    - attack.t1404
    - cve.2026.58868
logsource:
    product: intune
    service: manageddevice
detection:
    selection_os:
        operatingSystem: 'Android'
        osVersion|re: '^(14|15|16|17)([.]|$)'
    selection_patch:
        androidSecurityPatchLevel|re: '^(20(0|1)[0-9]|202[0-5]|2026-(0[0-9]|10)|2026-11-0[1-4])'
    condition: selection_os and selection_patch
falsepositives:
    - Devices awaiting OEM or carrier rollout of the 2026-11-05 level
    - Test or lab devices intentionally held back
level: high
```

**Known false positives:**

- Devices awaiting OEM or carrier rollout of the 2026-11-05 patch level
- Lab or test devices intentionally held back on older builds

**Tuning notes:** Index and sourcetype names (mdm / intune:manageddevice) are environment-specific; adjust to where Graph managedDevice data lands. The comparison uses ISO date strings, which sort lexicographically. Raise the threshold to 2026-11-01 only if kernel/vendor components are out of scope. The KQL flavor cannot filter on patch level because IntuneDevices does not carry it; it scopes the Android 14-17 population, so enrich from a Graph-sourced table if available. Add an OEM-delay exclusion list and a grace period of several days after bulletin publication (2026-11-02).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Successful Sign-ins From Non-Compliant Android Devices (Unpatched Exposure) (locked: unlock with TL Creds)
- Android Device Newly Reporting Root Or Jailbreak State (locked: unlock with TL Creds)
- Defender Alerts On Android Devices For Exploitation Or Privilege Escalation (locked: unlock with TL Creds)
- Android FrameDecoder onOutputReceived Backtrace In Native Crash (CVE-2026-58868) (locked: unlock with TL Creds)
- Android Media Codec Process Executing A Shell (locked: unlock with TL Creds)
- Android Media Codec Domain Process Opening Outbound Network Connection (locked: unlock with TL Creds)
- Android SELinux Denials From Media/App Domains Toward Kernel And Init Targets (locked: unlock with TL Creds)
- Repeated Native Crashes In Android Bluetooth, HID, WiFi Or Telephony Stack (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Android's November 2026 Updates Patch Over 200 Vulnerabilities (SecurityWeek)](https://www.securityweek.com/androids-november-2026-updates-patch-over-200-vulnerabilities/)
- [Android Security Bulletin - November 2026 (2026-11-01)](https://source.android.com/docs/security/bulletin/2026/2026-11-01)
- [NVD: CVE-2026-58868](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58868)
- [Android Security Bulletins index](https://source.android.com/docs/security/bulletin)
- [CISA Known Exploited Vulnerabilities catalog (feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5206