Google patches Android media flaw that requires no user interaction

Google's November Android update fixes a critical flaw that could allow remote code execution without user interaction or additional execution privileges, Cybernews reported. Tracked as CVE-2026-58868, the flaw affects supported Android versions 14 through 17 and lies in code that generates media preview images. The update addresses 216 vulnerabilities, including 23 rated critical. Users are advised to install security patch level 2026-11-01 or later, but manufacturers must build and distribute updates for their devices. Older Android versions may also be vulnerable. No public proof-of-concept exploit is available, and Google has not confirmed active exploitation.