A critical security flaw in Android 14 through Android 17 could allow hackers to run code on your phone without any action from you. The flaw, identified as CVE-2026-58868, enables remote code execution, giving bad actors potential control of your device.
Google has not confirmed any active exploits for this vulnerability yet. The company has released a patch, though it may not reach your phone immediately since manufacturers and carriers control when updates roll out.
To check if you have the patch, open Settings, tap "About phone" or "About tablet," and look at the Android version. Security patches dated November 1, 2026 or later will fix this issue. If your device shows an earlier date, you will need to wait for the update.
Google's latest security bulletin lists 216 vulnerabilities overall, with 23 marked as critical. Two other critical flaws could also allow remote code execution when exploited.