Google Patches Critical Android RCE Flaws That Let Attackers Execute Code Without User Interaction

Google 2026-yil noyabr oyidagi Android xavfsizlik byulletenini e'lon qildi, unda foydalanuvchi ishtiroki yoki qo'shimcha bajarish huquqlarisiz masofadan kod bajarishga imkon beruvchi muhim zaifliklar tuzatilgan.

2-noyabrda e'lon qilingan byulleten, eng jiddiy muammo sifatida framework zaifligini ta'kidlaydi va Android tizim komponentlaridagi boshqa muhim masofadan kod bajarish (RCE) zaifliklarini ham hujjatlashtiradi.

Google'ning noyabr xavfsizlik byulleteniga ko'ra, 2026-11-05 yoki undan yuqori xavfsizlik yamoq darajalari barcha tegishli muammolarni tuzatadi. Uchta muhim platforma RCE zaifligi Android 14, 15, 16, 16-QPR2 va 17 versiyalariga ta'sir qiladi, bu esa tuzatishni bir nechta qo'llab-quvvatlanadigan relizlar bo'yicha dolzarb qiladi.

Framework zaifligi CVE-2026-58868 Android kuzatuv ma'lumotnomasi A-486464711 bilan belgilanadi. Google ta'kidlashicha, ekspluatatsiya foydalanuvchi ishtirokini ham, qo'shimcha bajarish huquqlarini ham talab qilmaydi. Biroq, byulleten asosiy dasturlash xatosi, ekspluatatsiya yetkazish mexanizmi yoki aniq zaif interfeys haqida ma'lumot bermaydi.

Tizim komponentida yana ikkita muhim RCE zaifligi mavjud: CVE-2026-58876 va CVE-2026-58936. Google shuningdek, bo'limning eng jiddiy zaifligini foydalanuvchi ishtirokisiz ekspluatatsiya qilish mumkinligini ta'riflaydi. Ushbu ma'lumotlar avvalgi Android nol-bosish (zero-click) zaifliklari haqidagi xabarlardan keyin keladi, garchi noyabr muammolari alohida identifikatorlar va tuzatish talablariga ega bo'lsa-da.

Quyidagi jadval alohida ro'yxatga olingan yadro (kernel) va chipset muammolarini hisobga olmaganda, barcha muhim Framework va Tizim zaifliklarini umumlashtiradi.

Google'ning jiddiylik bahosi platforma va xizmat yumshatish choralari ishlab chiqish maqsadida o'chirilgan yoki muvaffaqiyatli aylanib o'tilgan deb taxmin qiladi. Shuning uchun, muhim reyting ushbu sharoitlarda potentsial ta'sirni tavsiflaydi; bu har bir yangilanmagan qurilma internetga ulangan xizmat orqali darhol ekspluatatsiya qilinishi mumkinligini anglatmaydi. Byulleten ushbu RCE zaifliklari uchun batafsil hujum zanjirini taqdim etmaydi.

E'tiborga loyiq jihat shundaki, CVE-2026-58876 Google Play tizim yangilanishlari bo'limida Media Codecs ostida ham paydo bo'ladi. Bu ushbu muammo uchun Project Mainline yetkazish yo'lini aniqlaydi, lekin noyabr oyidagi har bir zaiflikni faqat Google Play tizim yangilanishi orqali hal qilish mumkin degan ma'noni anglatmaydi.

Byulleten shuningdek, CVE-2026-58988 — qo'shimcha bajarish huquqlari yoki foydalanuvchi ishtirokini talab qilmaydigan yuqori jiddiylikdagi Android runtime ma'lumot oshkor qilish zaifligini ham tuzatadi. Boshqa bo'limlar yadro, modem, GPU va ishlab chiqaruvchiga xos zaifliklarni qamrab oladi.

2026-11-01 yamoq darajasi ro'yxatga olingan Framework va Tizim zaifliklarini qamrab oladi. Kengroq 2026-11-05 darajasi tegishli yadro va ishlab chiqaruvchi tuzatishlarini qo'shadi va avvalgi yamoq talablarini o'z ichiga oladi. Administratorlar boshqariladigan qurilmalarda tuzatishni tekshirishda ushbu darajalarni farqlashi kerak.

Google Android hamkorlari zaiflik haqida e'lon qilishdan kamida bir oy oldin xabardor qilinishini aytadi. Tegishli AOSP manba yamoqlari byulletenning dastlabki e'lonidan keyin 48 soat ichida rejalashtirilgan. Foydalanuvchilar mavjud ishlab chiqaruvchi yangilanishlarini o'rnatishi va faqat Android versiyasiga tayanmasdan, natijaviy xavfsizlik yamoq darajasini tekshirishi kerak.

Platforma mustahkamlash va Android Advanced Protection qo'shimcha himoya kontekstini ta'minlaydi, Google Play Protect esa potentsial zararli ilovalarni kuzatib boradi. Google yangi Android himoyalari ekspluatatsiya ehtimolini kamaytirishini ta'kidlaydi va iloji boricha eng so'nggi Android versiyasiga yangilanishni tavsiya qiladi.

SOC'ga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.

Google released its November 2026 Android Security Bulletin, which addresses critical vulnerabilities that could allow remote code execution without user interaction or additional execution privileges.

Published on November 2, the bulletin highlights a framework vulnerability as the most severe issue and also documents other critical remote code execution flaws in Android’s system components.

According to Google’s November security bulletin, security patch levels of 2026-11-05 or later address all applicable issues. The three critical platform RCE vulnerabilities affect Android 14, 15, 16, 16-QPR2, and 17, making remediation relevant across multiple supported releases.

The Framework flaw, CVE-2026-58868, carries Android tracking reference A-486464711. Google states that exploitation requires neither user interaction nor additional execution privileges. However, the bulletin does not disclose the underlying programming error, exploit delivery mechanism, or specific vulnerable interface.

The System component contains two additional critical RCE vulnerabilities: CVE-2026-58876 and CVE-2026-58936. Google similarly describes the section’s most severe vulnerability as exploitable without user interaction. These disclosures follow earlier Android zero-click vulnerability coverage, although the November issues have distinct identifiers and remediation requirements.

The following table summarizes all critical Framework and System vulnerabilities, excluding separately listed kernel and chipset issues.

Google’s severity assessment assumes platform and service mitigations are disabled for development or successfully bypassed. Consequently, a critical rating describes potential impact under those conditions; it does not establish that every unpatched device is immediately exploitable through an internet-facing service. The bulletin provides no detailed attack chain for these RCE flaws.

Notably, CVE-2026-58876 also appears under Media Codecs in the Google Play system updates section. This identifies a Project Mainline delivery path for that issue, but does not mean every November vulnerability can be resolved through a Google Play system update alone.

The bulletin also fixes CVE-2026-58988, a high-severity Android runtime information-disclosure vulnerability requiring no additional execution privileges or user interaction. Other sections address kernel, modem, GPU, and vendor-specific weaknesses.

The 2026-11-01 patch level covers the listed Framework and System flaws. The broader 2026-11-05 level adds applicable kernel and vendor fixes while incorporating previous patch requirements. Administrators should distinguish these levels when validating remediation across managed devices.

Google says Android partners receive vulnerability notifications at least one month before publication. Corresponding AOSP source patches are scheduled within 48 hours of the bulletin’s initial release. Users should install available manufacturer updates and verify the resulting security patch level rather than relying solely on their Android version.

Platform hardening and Android Advanced Protection provide additional defensive context, while Google Play Protect monitors potentially harmful applications. Google emphasizes that newer Android protections reduce the likelihood of exploitation and recommends updating to the latest available Android version wherever possible.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.