Google: Vulnerability in Qualcomm Android Component exploited by hackers

Google has confirmed that the critical vulnerability CVE-2026-21385 , which affects an open-source Qualcomm component in Android devices , has been exploited in attacks. 

Vulnerability in the Graphics component of Qualcomm 

CVE -2026-21385 is a buffer over-read vulnerability in the Graphics component and has a CVSS score of 7.8 . It is caused by memory corruption when adding user-supplied data without checking the available buffer space.

Qualcomm describes the issue as an integer overflow. The vulnerability was reported by Google 's Android Security team on December 18, 2025. Customers were notified of the security flaw on February 2, 2026. This means that there was a significant amount of time between discovery and public release during which the exploit was active. This time lag is particularly problematic, as it allowed attackers to continue exploiting the vulnerability in real-world conditions, potentially affecting thousands of users. 

See also: Chrome Vulnerability: Malicious Extensions and Gemini Panel

There are currently no details on how attackers are exploiting the vulnerability. However, Google acknowledged in its monthly Android that "there are indications that CVE-2026-21385 may be under limited, targeted exploitation."

Google is fixing many vulnerabilities

Google 's March 2026 update contains fixes for a total of 129 vulnerabilities . It's worth noting that the company only addressed one Android vulnerability in January 2026 and none last month. This dramatic increase in the number of fixes suggests either a buildup of issues identified over the past few months, or a more intensive vulnerability detection effort on the part of Google and its partners.

Critical flaws fixed in the March update include CVE-2026-0006, a critical vulnerability in the System that could lead to remote code execution without requiring additional privileges or user interaction. Also fixed are a privilege escalation vulnerability in Framework (CVE-2026-0047), a denial-of-service vulnerability in System (CVE-2025-48631) , and seven privilege escalation flaws in Kernel. Bundling so many critical vulnerabilities into one update puts additional pressure on device manufacturers to distribute fixes quickly.

See also: APT28 linked to MSHTML zero-day ahead of February Patch Tuesday

Technical details and protection recommendations

The Android security bulletin includes two levels of fixes – 2026-03-01 and 2026-03-05 – to give Android partners the flexibility to address common vulnerabilities across devices more quickly. The second level of fixes includes fixes for Kernel components , as well as those from Arm , Imagination Technologies , MediaTek , Qualcomm , and Unisoc . This tiered approach allows manufacturers to prioritize the most critical fixes and distribute them to end users faster.

To effectively protect against this threat, users should immediately apply the March 2026 Android security updates (levels 2026-03-01/05 ). In addition, it is recommended to enable Android Platform Protections and Google Play Protect . Users should also monitor Qualcomm bulletins for closed source fixes. It is especially important to enable automatic security updates where available, as well as avoid installing applications from unverified sources.

See also: Security flaw in Juniper Networks PTX routers

Organizations and businesses that manage large fleets of Android should prioritize updating devices that contain sensitive data or have access to critical systems. The targeted nature of the CVE-2026-21385 suggests that attackers may be focusing on specific sectors or organizations, making proactive protection even more critical.