Google noyabr oyidagi xavfsizlik byulletenida aytishicha, muhim Android zaifligi hujumchiga foydalanuvchining hech qanday harakatisiz telefonida kodni masofadan ishga tushirish imkonini berishi mumkin.
CVE-2026-58868 deb nomlangan zaiflik Android 14 dan 17 gacha versiyalarni ta'sir qiladi. Telefonlar 2026-11-01 yoki undan keyingi xavfsizlik patch darajasi bilan tuzatishni oladi, bu esa telefon ishlab chiqaruvchilari va operatorlar tomonidan o'z jadvallariga ko'ra tarqatiladi.
4-noyabr holatiga ko'ra, Google byulletenida uning zaifliklaridan foydalanib hujumlar haqida xabar berilmagan. Ularning hech biri AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) tomonidan yuritiladigan Ma'lum ekspluatatsiya qilingan zaifliklar katalogida 3-noyabr yangilanishi holatiga ko'ra yo'q edi.
Zaiflik FrameDecoder.cpp faylidagi onOutputReceived funksiyasida heap bufer to'lib ketishi natijasida yuzaga kelishi mumkin bo'lgan out-of-bounds yozuvdir. Na byulleten, na zaiflikning CVE yozuvi hujumchi bu kodga qanday yetishi mumkinligini aytmaydi.
Google'ning Critical (muhim) reytingi Android va Google xizmatlariga o'rnatilgan himoyalar o'chirilgan yoki chetlab o'tilgan deb taxmin qiladi.
Android 12 va 13 kabi eski versiyalar zaiflik ta'sir qiladiganlar ro'yxatida yo'q. Google yozuvlari ularda zaiflik bor-yo'qligini aytmaydi.
Telefoningizni qanday tekshirish mumkin
Google yordam sahifasi quyidagi qadamlarni beradi:
- Sozlamalar ilovasini oching.
- Telefon haqida yoki Planshet haqida, so'ngra Android versiyasi tugmasini bosing.
- Android xavfsizlik yangilanishi va Google Play tizim yangilanishi sanalarini toping.
Android xavfsizlik yangilanishi sanasi telefonning xavfsizlik patch darajasidir. 2026-11-01 yoki undan keyingi sana CVE-2026-58868 va Framework, System va Android runtime komponentlaridagi boshqa zaifliklarni qamrab oladi.
2026-11-05 yoki undan keyingi sana noyabr byulletenidagi har bir zaiflikni, jumladan kernel va Arm, Imagination Technologies, MediaTek, Unisoc va Qualcomm qismlaridagi zaifliklarni qamrab oladi.
Google telefon ishlab chiqaruvchilari barcha Android qurilmalari uchun umumiy tuzatishlar to'plamini tezroq tarqatishi uchun ikki sana belgilaydi. U ularni byulletenidagi har bir tuzatishni kiritishga rag'batlantiradi.
Android 10 yoki undan keyingi versiyalarda ishlaydigan telefonlar ba'zi tuzatishlarni Google Play tizim yangilanishlari orqali ham olishi mumkin. Ushbu oy uchun bu yangilanishlar ro'yxatida yana bir Critical zaiflik — CVE-2026-58876 ham bor.
CVE-2026-58868 bu ro'yxatda yo'q, shuning uchun uni tekshirish uchun Android xavfsizlik yangilanishi sanasiga qarash kerak.
Byulleten yangilanishni hali o'rnatolmaydigan telefonlar uchun hech qanday vaqtinchalik yechim bermaydi.
Android'ning matnli xabar kodidagi masofaviy xizmatdan bosh tortish zaifligi
Yana bir Critical zaiflik, CVE-2026-58882, CVE yozuviga ko'ra foydalanuvchi ishtirokisiz masofaviy xizmatdan bosh tortish hujumiga yo'l qo'yishi mumkin. U SMS orqali keladigan WAP Push xabarlarini qayta ishlash uchun Android kodidagi decodeWapPdu funksiyasida joylashgan.
29-oktabrda Mark B taxallusi bilan tanilgan tadqiqotchi "SMS of Death" (O'lim SMS'i) deb nomlangan yozuvni e'lon qildi, bu xuddi shu funksiyadagi xato haqida. Na byulleten, na CVE yozuvi CVE-2026-58882 aynan shu xato ekanligini aytmaydi.
Yozuvga ko'ra, bitta noto'g'ri tuzilgan WAP Push xabari com.android.phone'ni ishdan chiqaradi va har qanday faol qo'ng'iroqni, jumladan favqulodda qo'ng'iroqlarni ham tugatadi. Bir nechta telefon modellarida o'tkazilgan sinovlarda ishdan chiqish har safar sodir bo'lgan.
Hujumchiga faqat nishonning telefon raqami kerak, va xabar hech qachon kiruvchi xabarlar qutisida ko'rinmaydi. Telefon har safar ishga tushganda xabarni qayta urinishga harakat qiladi, shuning uchun xabar o'chirilmaguncha u ishga tushishda ishdan chiqishi mumkin.
Bunday xabarni bir telefondan boshqasiga yuboradigan proof-of-concept ilova ommaviy. Tadqiqotchining aytishicha, Android 12 va 13 ishlaydigan telefonlar xuddi shu kodni ishlatadi, lekin yangi versiyalar oladigan tuzatishni olmaydi.
Boshqa muhim zaifliklar
Google'ning noyabr byulletenida 216 ta zaiflik ro'yxatga olingan, ulardan 23 tasi Critical deb baholangan. Yana ikkita Critical zaiflik masofaviy kod ishga tushirishga yo'l qo'yishi mumkin: CVE-2026-58876 va CVE-2026-58936, ikkalasi ham Android'ning System komponentida.
Olti Critical zaiflik kernelda, ulardan ikkitasi Bluetooth kodida. Eng jiddiy kernel zaifligi masofaviy hujumchiga foydalanuvchi ishtirokisiz yuqori huquqlarni olish imkonini berishi mumkin.
2026-11-05 patch darajasi MediaTek modem kodidagi va Qualcomm'ning yopiq manbali komponentidagi Critical zaifliklarni ham tuzatadi. Noyabr byulletenida MediaTek o'zining Critical modem zaifliklarini out-of-bounds yozuvlari deb ta'riflaydi va faol ekspluatatsiya haqida bilmasligini aytadi.
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin.
The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules.
As of November 4, Google's bulletin did not report any attacks exploiting its flaws. None of them was in the Known Exploited Vulnerabilities catalog, kept by the U.S. Cybersecurity and Infrastructure Security Agency, as of its November 3 update.
The flaw is a possible out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of the file FrameDecoder.cpp. Neither the bulletin nor the flaw's CVE record says how an attacker would reach that code.
Google's Critical rating assumes that the protections built into Android and Google's services are turned off or bypassed.
Older versions, such as Android 12 and 13, are not listed as affected by the flaw. Google's records do not say whether they contain it.
How to Check Your Phone
Google's help page gives these steps:
- Open the Settings app.
- Tap About phone, or About tablet, then Android version.
- Find the dates for the Android security update and the Google Play system update.
The Android security update date is the phone's security patch level. A date of 2026-11-01 or later covers CVE-2026-58868 and the other flaws in the Framework, System, and Android runtime components.
A date of 2026-11-05 or later covers every flaw in the November bulletin, including those in the kernel and in parts from Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.
Google sets two dates so phone makers can ship a set of fixes common to all Android devices sooner. It encourages them to include every fix in the bulletin.
Phones running Android 10 or later may also receive some fixes through Google Play system updates. This month's list for those updates includes another Critical flaw, CVE-2026-58876.
CVE-2026-58868 is not on that list, so the date to check for it is the Android security update.
The bulletin gives no workaround for phones that cannot install the update yet.
A Remote Denial-of-Service Flaw in Android's Text-Message Code
Another Critical flaw, CVE-2026-58882, could allow a remote denial-of-service attack with no user interaction, according to its CVE record. It is in decodeWapPdu, a function in Android's code for WAP Push messages that arrive via SMS.
On October 29, a researcher who publishes as Mark B posted a write-up called "SMS of Death" about a bug in the same function. Neither the bulletin nor the CVE record says whether CVE-2026-58882 is that bug.
One malformed WAP Push message crashes com.android.phone and ends any active call, including emergency calls, according to the write-up. In tests on several phone models, the crash happened every time.
The attacker needs only the target's phone number, and the message never shows up in the inbox. The phone retries the message each time it starts, so it can crash on startup until the message is removed.
A proof-of-concept app that sends such a message from one phone to another is public. Phones running Android 12 and 13 run the same code but do not receive the fix that newer versions do, the researcher says.
Other Critical Flaws
Google's November bulletin lists 216 vulnerabilities, 23 of them rated Critical. Two more Critical flaws could allow remote code execution: CVE-2026-58876 and CVE-2026-58936, both in Android's System component.
Six Critical flaws are in the kernel, two of them in Bluetooth code. The most severe kernel flaw could allow a remote attacker to gain elevated privileges without user interaction.
The 2026-11-05 patch level also fixes Critical flaws in MediaTek modem code and in a closed-source Qualcomm component. In its November bulletin, MediaTek describes its Critical modem flaws as out-of-bounds writes and says it is not aware of any active exploitation.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.