NewsThe Hacker News
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Linked advisories
- CVE-2026-58868Google Android: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-58868Android Patchday November 2026 (Google Android, Automotive OS and XR): Mehrere Schwachstellen
- CVE-2026-58868OSV-Eintrag
- CVE-2026-58868Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868)
- CVE-2026-58868Samsung Products Multiple Vulnerabilities
- CVE-2026-58868Google Android: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-58868Android Multiple Vulnerabilities
Affected vendors and products
More on Interaction
Other advisories
- CriticalCVE-2026-58936Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868)
- Not ratedosv:CLEANSTART-2024-DU76225Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4
- Not ratedosv:CLEANSTART-2025-AE08215bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled
- Not ratedosv:CLEANSTART-2024-NA49468If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content
- Not ratedosv:CLEANSTART-2024-ST21379Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit
- Not ratedosv:CLEANSTART-2024-UF89680Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincip...
- Not ratedosv:CLEANSTART-2024-ZV91297<code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect
- Not ratedosv:CLSA-2026-1792389922TuxCare security update for @storybook/addon-interactions (1 CVE)
Other news entries
- Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionNewsThe Hacker News
- Android’s November 2026 Updates Patch Over 200 VulnerabilitiesNewsSecurityWeek
- LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local NetworkNewsThe Hacker News
- Zimbra Vulnerability Exploited in the Wild Prior to Public DisclosureNewsSecurityWeek
- A zero-click RCE flaw in AI coding agents could have exposed enterprise systemsNewsCSO Online
- NCSC-2026-0381 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle PeopleSoft EnterpriseNewsNCSC-NL
- Skullcandy Dime 3 earbuds expose users to Bluetooth hijackingNewsBleepingComputer
- OpenAI adds an AI safety layer to detect misuse without retaining enterprise dataNewsCSO Online
Source: https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html
ID