Qualcomm Zero-Day Exploited in Targeted Android Attacks

Google and Qualcomm disclosed two significant Android vulnerabilities: CVE-2026-21385 (a Qualcomm graphics kernel integer overflow with indications of limited, targeted exploitation) and CVE-2026-0047 (a critical local privilege escalation in Android's System component). Patches are available, CVE-2026-21385 was added to CISA's KEV catalog, but consumer exposure may persist due to OEM-dependent patch rollouts and the potential for these flaws to be leveraged in chained attacks or by commercial/nation-state actors.