NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksUpdated

Android March 2026 update fixes exploited Qualcomm chip flaw CVE-2026-21385

Google's March 2026 Android update fixes CVE-2026-21385, a Qualcomm memory flaw possibly used in limited, targeted attacks. CISA lists it as exploited. Install updates until your phone shows a security patch level of 2026-03-05 or later.

What to do

Open Settings, then Security or System update, and install any available Android update until your security patch level reads 2026-03-05 or later. If your phone's maker has stopped issuing updates, consider replacing it, especially for executives or anyone likely to be targeted.

Check your devices
  • Androidfixed in 2026-03-05 security patch level and later

What’s happening

Google's March 2026 Android Security Bulletin, published on 2 March 2026, fixes CVE-2026-21385. It is a high-severity memory-corruption flaw in the Display part of Qualcomm components, and the bulletin says there are indications it may be under limited, targeted exploitation. Qualcomm rates it CVSS 7.8. Reports say it affects well over 200 Qualcomm chipsets, though the counts differ between outlets, so a very large share of Android phones with Qualcomm chips could be exposed. CISA added it to its list of flaws being used in attacks on 3 March 2026. The fix is included in the 2026-03-05 security patch level, so a phone showing that date or later has it. Google fixes its own Pixel phones, but other makers deliver the update on their own schedules, so some devices may still be unpatched. No public source names who is behind the attacks. One outlet suggests commercial spyware or state groups as a possibility, which is speculation, not attribution.

What
Flaw
Affects
Android phones and tablets with Qualcomm chipsets
Affected
Android devices using affected Qualcomm chipsets (security patch level earlier than 2026-03-05)
Fixed in
Android security patch level 2026-03-05 or later
CVE
CVE-2026-21385
Since
2 Mar 2026

Timeline

  1. Update

    The Android bulletin page shows a last-updated date of 12 October 2026. The page does not say what changed for this flaw, and the vendor's wording on exploitation is unchanged.

  2. CISA added

    CISA adds CVE-2026-21385 to its Known Exploited Vulnerabilities catalogue, with a US federal agency fix deadline of 24 March 2026.

  3. Made publicPartly fixed

    Google's March 2026 Android Security Bulletin lists CVE-2026-21385, a high-severity flaw in the Display part of Qualcomm components, and says there are indications it may be under limited, targeted exploitation. The fix arrives with the 2026-03-05 security patch level.

Sources

  1. Android Security Bulletin: March 2026Google (Android Open Source Project) · 2 Mar 2026
  2. CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Android AttacksSOC Prime · 4 Mar 2026
  3. Qualcomm Zero-Day Exploited in Targeted Android AttacksDark Reading · 3 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS