Android Security Bulletin — November 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 4

• Critical 9.8
  CVE-2026-58868 Public exploit In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with n…
• Critical 9.8
  CVE-2026-58876 In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution p…
• Critical 9.8
  CVE-2026-58936 In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional executi…
• Critical 9.8
  CVE-2026-58968 In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no addi…

All vulnerabilities 139