Overview
- Google published two Android security patch levels that together fix 216 vulnerabilities, 23 of them rated Critical.
- The first update, published on November 1, contains 119 fixes and remedies the most severe bug, CVE-2026-58868, a heap buffer overflow in FrameDecoder.cpp that could allow remote code execution without user interaction on Android 14–17.
- The second update, published on November 5, adds 97 fixes that target kernel issues and closed-source vendor components from MediaTek, Qualcomm and others including critical Bluetooth, pKVM and modem flaws.
- Researcher write-ups about a WAP Push/SMS crash called the 'SMS of Death' map to the same decodeWapPdu code area fixed in the bulletin but Google and the CVE records do not explicitly confirm they describe the identical bug.
- As of early November there are no confirmed active exploits listed in Google’s bulletin or CISA’s Known Exploited Vulnerabilities catalog, but staggered vendor rollouts and closed-source kernel/modem code keep risk and analysis uncertainty for many users.