Android Zero-Click Flaw: Your Phone Could Be Hacked Without a Tap

An Android security flaw could allow an attacker to run malicious code on a vulnerable phone without its owner clicking a link, opening an attachment or approving an action.

Google disclosed the critical vulnerability, tracked as CVE-2026-58868, in its November 2026 Android Security Bulletin, published on November 2. The flaw affects the Android Framework and could lead to remote code execution without additional execution privileges or user interaction.

The published vulnerability record lists Android 14, 15, 16, 16 QPR2 and 17 as affected versions. Google has included a fix in its November security update, but that does not mean every Android phone has already received it. Manufacturers and carriers control when updates reach many devices.

For users, the immediate question is simple: what security patch is installed on your phone, and has its manufacturer delivered the November fix?

What is the Android zero-click flaw?

CVE-2026-58868 is a critical remote-code-execution vulnerability in the Android Framework.

The technical description identifies a heap buffer overflow in FrameDecoder.cpp, specifically in the onOutputReceived function. The error can cause an out-of-bounds write, meaning a program may write data beyond the memory space allocated for it.

If an attacker can trigger the flaw under the necessary conditions, it could allow malicious code to run on the affected device.

Google’s vulnerability description states that exploitation does not require additional execution privileges or user interaction. This is why the issue is described as a zero-click vulnerability.

In practical terms, the owner would not necessarily have to tap a suspicious link or install a malicious app for exploitation to occur.

However, the public description does not establish that an attacker can take control of any Android phone instantly or that every device running an affected Android version is currently exposed. The vulnerability’s technical conditions and the security updates installed on the device matter.

Which Android phones could be affected?

The CVE record identifies these Android versions as affected:

• Android 14
• Android 15
• Android 16
• Android 16 QPR2
• Android 17

These are the Android platform versions identified in the published CVE record, not a confirmed list of individual phone models. A phone running one of these versions is not automatically proof that it remains vulnerable: its software build and installed security patch level also matter.

Two phones running the same Android version may have different security patch levels. That is why checking your device’s security update date is more useful than relying on the Android version alone.

Google disclosed other critical Android flaws too

CVE-2026-58868 is not the only critical remote-code-execution issue in the November bulletin.

Google also lists two critical vulnerabilities in the Android System component:

• CVE-2026-58876: A use-after-free memory-safety issue that could lead to remote code execution without additional execution privileges or user interaction.
• CVE-2026-58936: A separate use-after-free issue involving Android’s PNG decoder that could also lead to remote code execution without additional execution privileges or user interaction.

These are separate flaws affecting different parts of Android. They should not be confused with CVE-2026-58868 or presented as evidence of a single combined attack.

The wider November bulletin includes additional fixes for privilege escalation, information disclosure and denial-of-service vulnerabilities. This is why installing the complete security update available for your device matters, rather than focusing only on one CVE number.

Why is a zero-click vulnerability particularly concerning?

Many familiar cyberattacks rely on tricking someone into taking an action. A criminal might send a fake delivery message, persuade someone to open an attachment or direct them to a fraudulent website.

A zero-click vulnerability creates a different risk. If an attacker can reach and trigger the vulnerable software component under the required conditions, the device owner may not need to interact with anything.

Remote code execution is particularly serious because it can allow an attacker to make a vulnerable device run code without the owner’s approval.

But there is an important distinction between a vulnerability’s potential impact and a confirmed attack. Google’s bulletin documents the security weaknesses and their severity. It does not, by itself, establish that criminals are already using CVE-2026-58868 to compromise ordinary users’ phones.

Has Google released a fix?

Yes. CVE-2026-58868 is included in Google’s November 2026 Android security bulletin under the 2026-11-01 security patch level.

Google’s bulletin also identifies a second security patch level, 2026-11-05, which covers additional kernel and hardware-component fixes. This is a separate patch level, not a date by which every Android phone is guaranteed to receive an update.

Google’s November bulletin distinguishes between the two patch levels. A device with the 2026-11-01 security patch level or later addresses the vulnerabilities associated with that patch level. Manufacturers and carriers still determine when the relevant updates reach individual supported devices.

How to check whether your Android phone is protected

You can check your phone’s security patch level in Settings. The exact menu names may vary slightly between manufacturers.

1. Open Settings.
2. Tap About phone or About tablet.
3. Select Android version.
4. Find the Android security update date.
5. Return to Settings and open System or Software update to check for available updates.

Google provides these instructions in its official Android update guidance.

If your manufacturer has made the relevant November security update available for your device, install it. Keep the phone charged and use a reliable internet connection while the update downloads and installs.

Do not assume that an Android version number alone confirms protection. The security patch date and your manufacturer’s update information are the important details.

What if the November update is not available on your phone?

You may not receive the update at the same time as someone using a different Android brand or model.

Google says update schedules can vary by device, manufacturer and mobile carrier. Some manufacturers also release updates in stages or across different regions.

If the November update is not showing on your phone:

• Check again through your phone’s official software-update settings.
• Visit the manufacturer’s official support or security-update page.
• Install other available security updates rather than postponing them.
• Avoid unofficial firmware files or apps claiming to provide an emergency fix.
• If your phone no longer receives security updates, consider replacing it with a supported device, particularly if you use it for banking or sensitive accounts.

There is no verified workaround for CVE-2026-58868 that involves switching off Bluetooth, avoiding public Wi-Fi or changing unrelated network settings. Installing the appropriate manufacturer-provided security update is the practical protection.

Samsung users: check the November security rollout

Samsung published its November 2026 Mobile Security update information on November 3. Its bulletin lists CVE-2026-58868, CVE-2026-58876 and CVE-2026-58936 among the Google Android vulnerabilities addressed in its November security maintenance release.

Samsung says security-patch availability can vary by device model and region. Its November bulletin confirms that the listed vulnerabilities are included in its maintenance release, but it does not establish that every Samsung phone has already received those fixes.

This is useful confirmation that the Android vulnerabilities are being incorporated into manufacturer security updates. It does not mean every Samsung phone has received the update already.

Samsung owners should check their device’s software-update settings and the company’s official Mobile Security page for relevant rollout information.

Owners of other Android brands should follow the same approach using their own manufacturer’s official support channels.

What remains unknown?

Google has published the vulnerability descriptions, affected Android versions and security patch information. However, the public disclosures reviewed for this report do not establish:

• How many phones remain unpatched.
• Whether attackers have successfully exploited CVE-2026-58868 in real-world attacks.
• Whether a working public exploit is available.
• How quickly every manufacturer will distribute the relevant fixes.
• Which individual phone models remain exposed without their manufacturers’ update information.

These gaps matter. A critical vulnerability deserves attention, but its severity should not be turned into an unsupported claim that millions of phones have already been hacked.

How We Checked This

We reviewed Google’s November 2026 Android Security Bulletin, including the Framework and System vulnerability tables and the two security patch levels.

We also checked the published records for CVE-2026-58868, CVE-2026-58876 and CVE-2026-58936.

For consumer guidance, we used Google’s official instructions for checking and installing Android updates. We separately reviewed Samsung’s November 2026 security update to check how the manufacturer is addressing the Google vulnerabilities.

This report distinguishes between vulnerabilities disclosed by Google, fixes included in the Android security bulletin and updates actually delivered to individual devices. We have not treated the disclosure as evidence of confirmed widespread exploitation.