Android's November update fixes a flaw that needs no tap at all

Google published its November Android security bulletin on Monday 2 November, and the top entry is the kind that matters: CVE-2026-58868, a heap overflow in a part of the Framework that decodes video frames. Google rates it critical because it could let an attacker run code on a phone remotely, with no extra permissions and no action from you. It affects Android 14, 15, 16 and 17. Google hasn't said how an attacker would reach the buggy code, and as of Wednesday there were no reports of it being used in attacks.

It's one of 216 fixes, 23 of them critical, including two in Bluetooth and a batch in MediaTek and Qualcomm chip code. The bulletin also formally lists CVE-2026-58882, the "SMS of Death" bug we covered on Monday. Its fix had already gone out quietly in October, and now it's on the record.

Why rush when nothing's been exploited? Because once a fix is public, attackers work backwards from it. This week the security firm Sekoia described a campaign it attributes to APT29, the Russian group also known as Midnight Blizzard, that planted exploit code on hacked and look-alike websites. Phones that visited were profiled and attacked automatically, with no tap needed. Every flaw involved had already been patched. The victims were iPhones still on iOS 16.7 or 18.5 and Android phones running Chrome versions 139 to 145, and the attackers went after WhatsApp and Telegram data, saved passwords, photos and location.

So go to Settings, then About phone, and find the Android security update date. You want 2026-11-01 at the very least, and 2026-11-05 covers the whole bulletin. Your phone maker decides when it arrives, so if it's not there yet, check again next week, and update Chrome from the Play Store while you're at it. On a PC, Tendvane's check-for-updates and its winget-based app updates do the same job: they show you the fixes that already exist but haven't been installed yet.