Google Android patches 100+ vulnerabilities under active exploit
Google patched 100+ Android vulnerabilities including CVE-2026-21385 under active exploit, enabling remote code execution and privilege escalation across Framework, System, and chipset components.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-21385 as exploited in the wild.
Google released the March 2026 Android security bulletin addressing over 100 vulnerabilities affecting Android OS patch levels prior to 2026-3-5. The most severe flaws enable remote code execution in the System component and privilege escalation across Framework, System, and Kernel layers. Successful exploitation allows attackers to install programs, modify or delete data, and create privileged accounts.
Critically, Google confirmed that CVE-2026-21385, a vulnerability in Qualcomm components, is under limited, targeted exploitation in the wild. The bulletin also addresses numerous elevation-of-privilege vulnerabilities in Framework (26 CVEs), System (7 CVEs), and Kernel (15 CVEs), plus flaws in third-party chipset components from Qualcomm, Arm, MediaTek, Imagination Technologies, and Unisoc.
The advisory classifies exploitation under MITRE ATT&CK technique T1203 (Exploitation for Client Execution). Organizations are urged to apply the March 2026 security patch immediately, particularly given the active exploitation of at least one Qualcomm component vulnerability.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-remote-code-execution_2026-017
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs