Google addresses actively exploited Qualcomm zero-day in fresh batch of 129 Android vulnerabilities

Google disclosed an actively exploited zero-day (CVE-2026-21385), a high-severity memory-corruption flaw in an open-source Qualcomm display component affecting 234 Qualcomm chipsets; Qualcomm issued fixes to customers and the bug was included in the March 2026 Android security bulletin, but details about the extent and victims of exploitation were not disclosed.