Google March Android Security Bulletin Patches 129 Flaws Including Actively Exploited Qualcomm Display Zero-Day

Google released the March 2026 Android Security Bulletin, issuing fixes for 129 vulnerabilities across the Android ecosystem and shipping two patch levels (2026-03-01 and 2026-03-05) to help OEMs stage platform and hardware-specific updates. The most urgent issue is CVE-2026-21385, a high-severity, actively exploited zero-day in an open-source Qualcomm display component used in Android devices with affected Qualcomm/Snapdragon chipsets.

Reporting indicates CVE-2026-21385 is a memory-corruption flaw caused by an integer overflow/wraparound condition that can lead to memory corruption during allocation/alignment in display drivers; successful exploitation could enable device compromise (e.g., arbitrary code execution and/or privilege escalation) and bypass security boundaries. Google and Qualcomm both acknowledged limited, targeted exploitation in the wild, and one account attributes discovery/confirmation of exploitation to Google’s Threat Analysis Group (TAG); devices not updated to at least patch level 2026-03-05 remain exposed, making rapid patch deployment and user update compliance the primary risk-reduction actions.