Google Patches Critical Android RCE and SMS Flaws

Google released patches for a critical Android remote code execution flaw affecting devices running Android 14 through 17. The vulnerability stems from a heap buffer overflow in system framework code that could enable attackers to run arbitrary code remotely without user interaction. The fix arrives with the November 1, 2026 security patch level, though deployment timing depends on device manufacturers and carriers. As of early November, no active exploitation has been reported.

A second critical flaw in Android’s text messaging handler enables remote denial-of-service attacks through malformed SMS messages. A single crafted message crashes the phone’s calling service and disrupts active calls, including emergency ones, with crashes persisting on startup until the message is manually removed. Public proof-of-concept exploits are available, and while Android 12 and 13 contain the vulnerable code, this bulletin does not include patches for those versions.

Google’s November security bulletin addresses 216 vulnerabilities total, with 23 rated critical. Beyond the two major remote code execution and denial-of-service flaws, additional critical issues affect the kernel, Bluetooth implementation, and proprietary modem firmware from vendors including MediaTek and Qualcomm. Users should verify their device’s security patch date through Settings; complete November coverage requires patch level 2026-11-05 or later, though the specific RCE flaw requires only 2026-11-01.