Google Patches 129 Android Flaws, Including Exploited Qualcomm Issue

Google released its March 2026 Android Security Bulletin on Monday, announcing patches for 129 vulnerabilities affecting Android devices worldwide. Among these is a high-severity flaw in a Qualcomm graphics component that security researchers have confirmed is under limited, targeted exploitation in the wild.

The exploited vulnerability, identified as CVE-2026-21385 with a CVSS score of 7.8, involves an integer overflow or wraparound issue that can lead to memory corruption during memory allocation alignments. Qualcomm described it as affecting the open-source components of more than 200 of its chipsets, potentially allowing attackers to access sensitive data or bypass security controls. The company received the report from Google's Android Security team on December 18, 2025, and notified customers on February 2, 2026. Google stated in its bulletin that indicators suggest the flaw is being targeted in a limited manner, though it provided no specifics on the nature or scope of the attacks. Such vulnerabilities have previously been leveraged by commercial spyware operators to compromise devices.

To address the full set of issues, Google divided the updates into two patch levels:...