MAG212 CYBER ORIGINAL ARTICLE

Android CVE-2026-58868 and Chrome 157: November Patches for Phones and Browsers

November 5, 2026 · El Mostafa Ouchen

Google’s November updates fix a critical Android Framework flaw, CVE-2026-58868, that could allow remote code execution with no extra privileges and no user interaction. Chrome 157 also reached the stable channel with 213 security fixes. Neither has confirmed exploitation in the sources we checked, but phones and browsers make up the largest attack surface most organizations have, so both deserve a quick patch cycle.

Key facts

Item	Detail
Android bulletin	Published November 2, 2026 (patch levels 2026-11-01 and 2026-11-05)
CVE-2026-58868	Critical, Framework, remote code execution; no extra privileges or user interaction needed
Affected Android	14, 15, 16 (including QPR2) and 17
Fix volume	SecurityWeek counts more than 200 fixes across the bulletin
Chrome 157	157.0.8103.38/.39 (Windows, Mac), .38 (Linux); 213 security fixes, 7 Critical, including Dawn and ANGLE
Exploitation	Not confirmed for either, per the sources we checked

Android: what the two patch levels mean

Google’s bulletin splits fixes into two patch levels. 2026-11-01 covers the Framework and System components, which is where CVE-2026-58868 sits. 2026-11-05 includes everything in the first level plus vendor and kernel fixes. A device at 2026-11-05 or later has the full set. Pixel devices usually update first; other manufacturers and carriers follow on their own schedules.

Chrome 157

Chrome 157 moved to stable with 213 security fixes, seven of them rated Critical, including bugs in Dawn (WebGPU) and ANGLE (graphics). Google hasn’t said any are being exploited. Chrome updates in the background, but the fix only takes effect after the browser restarts, and long-running browser sessions are the usual gap.

What to do, in order

Push Android updates through your MDM and set the minimum security patch level to 2026-11-01. Raise it to 2026-11-05 as manufacturers ship it.
Find devices that can’t update. Android 13 and older are not listed in this bulletin. Flag end-of-support devices for replacement or restrict their access.
Force a Chrome relaunch through your browser management policy so 157 actually takes effect, and confirm the version in your inventory.
Check other Chromium browsers (Edge, Brave, Opera, Electron apps) for their 157-based releases.

How to check a device

On an Android device: Settings › About phone › Android version › Android security update. For a device connected over USB with debugging enabled, this read-only command prints the patch level (Windows, macOS or Linux with Android platform tools; no root needed; not tested by MAG212):

adb shell getprop ro.build.version.security_patch

A result of 2026-11-01 or later includes the CVE-2026-58868 fix. In Chrome, open chrome://settings/help to see the version and trigger the update.

Also on the radar

SecurityWeek reports a botnet called XCPE involving about 1.3 million Android devices, linked to Videostrong hardware. Details are limited, so treat it as reported, not confirmed. Cheap Android TV boxes and other unmanaged devices don’t belong on corporate networks.

Frequently asked questions

Is CVE-2026-58868 being exploited?

Google’s bulletin doesn’t flag it as exploited, and no source we checked reports exploitation.

Which Android patch level do I need?

2026-11-01 or later fixes CVE-2026-58868. 2026-11-05 includes the full November set.

Is Chrome 157 an emergency update?

No exploitation has been reported, but seven Critical fixes are a good reason to make sure every browser has restarted on 157.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free