Google Flags Possible Limited Exploitation of Qualcomm Android Flaw CVE-2026-21385
Summary
Google says CVE-2026-21385, a high-severity flaw in a Qualcomm Graphics component used by Android, may face limited, targeted exploitation. The March 2026 Android update includes 129 vulnerability fixes.
Key points
- Google reported indications that CVE-2026-21385 may be under limited, targeted exploitation; the article gives no details on the exploitation method.
- The flaw is a buffer over-read in an open-source Qualcomm Graphics component used in Android and is described as resulting from an integer overflow.
- Qualcomm said Google’s Android Security team reported the flaw on December 18, 2025, and customers were notified on February 2, 2026.
- Google’s March 2026 Android update patches 129 vulnerabilities, including critical System remote code execution flaw CVE-2026-0006.
- The update provides March 1 and March 5 patch levels; the latter includes Kernel fixes and vendor patches from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc.
Article Details
- Event Type
- Google disclosed and patched an actively exploited vulnerability in a Qualcomm Graphics component used in Android devices.
- Impact
- CVE-2026-21385 is a high-severity integer overflow causing a buffer over-read. Google said there are indications of limited, targeted exploitation, but the article reports no details about how it is being exploited. The March 2026 Android update includes a patch for the flaw among 129 fixes, including additional critical vulnerabilities affecting System, Framework, and Kernel components.
CVE
CVE-2024-43859Linux · Linux(CVE-2026-0047), a System DoS (CVE-2025-48631), and seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2025-48631Google · AndroidAdditional critical fixes address a Framework privilege escalation (CVE-2026-0047), a System DoS (CVE-2025-48631), and seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038,CVE-2026-0006Google · AndroidGoogle’s March 2026 Android update patches 129 vulnerabilities, including a critical System remote code execution bug (CVE-2026-0006).CVE-2026-0027Google · Androidand seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0028Google · Androidseven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0030Google · Androidescalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0031Google · Androidflaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0037Google · Androida System DoS (CVE-2025-48631), and seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0038Google · AndroidDoS (CVE-2025-48631), and seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038, CVE-2026-0027, CVE-2026-0028, CVE-2026-0030, CVE-2026-0031).CVE-2026-0047Google · AndroidAdditional critical fixes address a Framework privilege escalation (CVE-2026-0047), a System DoS (CVE-2025-48631), and seven Kernel privilege escalation flaws (CVE-2024-43859, CVE-2026-0037, CVE-2026-0038,CVE-2026-21385Qualcomm · 5g fixed wireless access platform firmware; Qualcomm · Apq8098 firmware; +235 moreGoogle disclosed a high-severity vulnerability (CVE-2026-21385) in an open-source Qualcomm Graphics component used in Android devices that has been exploited in the wild.
Vendors
ArmTwo patch levels (2026-03-01 and 2026-03-05) give partners flexibility; the second level includes Kernel fixes and vendor patches from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc.GoogleGoogle disclosed a high-severity vulnerability (CVE-2026-21385) in an open-source Qualcomm Graphics component used in Android devices that has been exploited in the wild.Imagination TechnologiesTwo patch levels (2026-03-01 and 2026-03-05) give partners flexibility; the second level includes Kernel fixes and vendor patches from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc.MediaTekTwo patch levels (2026-03-01 and 2026-03-05) give partners flexibility; the second level includes Kernel fixes and vendor patches from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc.QualcommGoogle disclosed a high-severity vulnerability (CVE-2026-21385) in an open-source Qualcomm Graphics component used in Android devices that has been exploited in the wild.UnisocTwo patch levels (2026-03-01 and 2026-03-05) give partners flexibility; the second level includes Kernel fixes and vendor patches from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unisoc.