{"id":"android-qualcomm-display-zero-day-mar-2026","category":"patch","status":"live","title":"Android March 2026 update fixes exploited Qualcomm chip flaw CVE-2026-21385","tldr":"Google's March 2026 Android update fixes CVE-2026-21385, a Qualcomm memory flaw possibly used in limited, targeted attacks. CISA lists it as exploited. Install updates until your phone shows a security patch level of 2026-03-05 or later.","summary":"Google's March 2026 Android Security Bulletin, published on 2 March 2026, fixes CVE-2026-21385. It is a high-severity memory-corruption flaw in the Display part of Qualcomm components, and the bulletin says there are indications it may be under limited, targeted exploitation. Qualcomm rates it CVSS 7.8. Reports say it affects well over 200 Qualcomm chipsets, though the counts differ between outlets, so a very large share of Android phones with Qualcomm chips could be exposed. CISA added it to its list of flaws being used in attacks on 3 March 2026. The fix is included in the 2026-03-05 security patch level, so a phone showing that date or later has it. Google fixes its own Pixel phones, but other makers deliver the update on their own schedules, so some devices may still be unpatched. No public source names who is behind the attacks. One outlet suggests commercial spyware or state groups as a possibility, which is speculation, not attribution.","action":"Open Settings, then Security or System update, and install any available Android update until your security patch level reads 2026-03-05 or later. If your phone's maker has stopped issuing updates, consider replacing it, especially for executives or anyone likely to be targeted.","product":"Android phones and tablets with Qualcomm chipsets","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-21385"],"tags":["android","qualcomm","zero-day","exploited","cisa-kev","memory-corruption","mobile"],"affected":["Android devices using affected Qualcomm chipsets (security patch level earlier than 2026-03-05)"],"fixed":["Android security patch level 2026-03-05 or later"],"matches":[{"platform":"android","app":"Android","bundle":"","fixed":"2026-03-05 security patch level"}],"sources":[{"kind":"advisory","title":"Android Security Bulletin: March 2026","url":"https://source.android.com/docs/security/bulletin/2026/2026-03-01","by":"Google (Android Open Source Project)","date":"2026-03-02"},{"kind":"news","title":"CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Android Attacks","url":"https://socprime.com/blog/cve-2026-21386-vulnerability/","by":"SOC Prime","date":"2026-03-04"},{"kind":"news","title":"Qualcomm Zero-Day Exploited in Targeted Android Attacks","url":"https://darkreading.com/threat-intelligence/qualcomm-zero-day-exploited-targeted-android-attacks","by":"Dark Reading","date":"2026-03-03"}],"started":"2026-03-02","closed":null,"created":"2026-11-03T21:22:53.279Z","updated":"2026-11-03T21:22:53.279Z","cve_notes":[{"cve":"CVE-2026-21385","name":"Memory corruption in Qualcomm chipset Display component","what":"A memory-corruption flaw in the Display part of Qualcomm components, triggered during memory allocation, that an attacker with a foothold on a phone could use to take it over, and which Google says may be under limited, targeted exploitation.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-12","added":"2026-11-03T21:19:18.455Z","kind":"other","text":"The Android bulletin page shows a last-updated date of 12 October 2026. The page does not say what changed for this flaw, and the vendor's wording on exploitation is unchanged.","url":"https://source.android.com/docs/security/bulletin/2026/2026-03-01","by":"Google (Android Open Source Project)","patch":null},{"at":"2026-03-03","added":"2026-11-03T21:19:18.455Z","kind":"cisa-added","text":"CISA adds CVE-2026-21385 to its Known Exploited Vulnerabilities catalogue, with a US federal agency fix deadline of 24 March 2026.","url":"https://socprime.com/blog/cve-2026-21386-vulnerability/","by":"SOC Prime","patch":null},{"at":"2026-03-02","added":"2026-11-03T21:19:18.455Z","kind":"disclosed","text":"Google's March 2026 Android Security Bulletin lists CVE-2026-21385, a high-severity flaw in the Display part of Qualcomm components, and says there are indications it may be under limited, targeted exploitation. The fix arrives with the 2026-03-05 security patch level.","url":"https://source.android.com/docs/security/bulletin/2026/2026-03-01","by":"Google (Android Open Source Project)","patch":"partial"}],"url":"https://hard.fyi/live/android-qualcomm-display-zero-day-mar-2026/","json":"https://hard.fyi/api/live?id=android-qualcomm-display-zero-day-mar-2026"}