Google patches 100+ Android flaws, CVE-2026-21385 exploited
Google patched over 100 vulnerabilities in Android OS, including CVE-2026-21385, a Qualcomm flaw under limited targeted exploitation that could enable remote code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-21385 as exploited in the wild.
Google has released its March 2026 Android security bulletin addressing multiple vulnerabilities across the Android operating system, with the most severe flaws enabling remote code execution. The advisory covers patches for vulnerabilities spanning the Android Framework, System components, kernel, and third-party chipset components from Arm, Qualcomm, MediaTek, Imagination Technologies, and Unisoc. Affected devices include those running Android OS patch levels prior to 2026-3-5.
The most critical aspect of this bulletin is CVE-2026-21385, a Qualcomm component vulnerability that Google indicates is under limited, targeted exploitation in the wild. Successful exploitation of the most severe vulnerabilities could allow attackers to execute arbitrary code, potentially leading to full device compromise. Depending on the privileges associated with the exploited component, attackers could install programs, access or modify data, or create new accounts with elevated rights.
The bulletin addresses 26 Framework elevation-of-privilege vulnerabilities, 7 System elevation-of-privilege flaws, 15 kernel privilege escalation issues, and multiple vulnerabilities in vendor-specific components. Lower-severity issues include information disclosure and denial-of-service vulnerabilities. Organizations are advised to apply the March 2026 security patches immediately following appropriate testing, particularly for devices in sensitive environments given the active exploitation of at least one vulnerability.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-remote-code-execution_2026-017
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs