Alerts

Qualcomm Zero-Day CVE-2026-21385 Exploited in Targeted Android Attacks — Possible Spyware or Nation-State Links

Zero Day Wire

— 2 min read
Qualcomm Zero-Day CVE-2026-21385 Exploited in Targeted Android Attacks — Possible Spyware or Nation-State Links

Google's March 2026 Android security bulletin confirms that CVE-2026-21385, a high-severity memory corruption vulnerability in Qualcomm's graphics kernel, is under "limited, targeted exploitation" — language that security researchers say is consistent with commercial spyware operations or nation-state threat activity.

The flaw, which carries a CVSS score of 7.8, affects a wide range of Qualcomm chipsets and has been added to CISA's Known Exploited Vulnerabilities catalog. Patches are available but deployment depends on individual OEMs, creating a lag that attackers are actively exploiting.

The Vulnerability

CVE-2026-21385 is an integer overflow in Qualcomm's graphics kernel that leads to memory corruption during memory allocation alignment operations. Qualcomm describes it as "memory corruption while using alignments for memory allocation."

The flaw requires local access to exploit, meaning an attacker needs an initial foothold on the device — typically through a phishing link, malicious app, or a separate remote code execution vulnerability — before chaining CVE-2026-21385 for privilege escalation.

Spyware Signature

Google's description of "limited, targeted exploitation" is significant. Security experts note this is the specific language Google uses when exploitation activity is too narrow to be criminal infrastructure but too deliberate to be opportunistic.

Adam Boynton, senior security strategy manager at Jamf, drew parallels to a previous Qualcomm zero-day: "CVE-2024-43047 — another Qualcomm zero-day — used the same language when it was disclosed, and it was later tied to commercial spyware tooling via Amnesty International's Security Lab. That's not confirmation of the same here, but the profile is consistent."

Neither Google nor Qualcomm have disclosed details about who is behind the exploitation or which targets were affected.

Second Critical Flaw in the Same Bulletin

The March bulletin also includes CVE-2026-0047, a critical local privilege escalation in Android's System component caused by a missing permission check in dumpBitmapsProto of ActivityManagerService.java. Google warns it "could lead to remote code execution with no additional execution privileges needed" and requires no user interaction.

While CVE-2026-0047 has not been observed exploited in the wild, experts assess it is likely to be chained with other vulnerabilities in future attacks. The barrier to exploitation is the need for existing device access — but once combined with an initial access vector, the escalation path is significant.

The OEM Patching Gap

Patches for CVE-2026-21385 have been shared with OEMs, but consumer exposure depends entirely on how quickly device manufacturers integrate and push updates. Unlike iOS where Apple controls the entire pipeline, Android's fragmented update model means that even with patches available at disclosure, millions of devices remain vulnerable for weeks or months.

Qualcomm urged customers to "contact the device manufacturer for information on the patching status of released devices" — an acknowledgment that Qualcomm itself cannot force timely updates to end users.

Defender Recommendations

  • Apply March 2026 Android security patches immediately — prioritize devices running Qualcomm chipsets
  • Enterprise MDM enforcement — use mobile device management to verify patch levels and restrict access for unpatched devices
  • Monitor for exploitation chains — CVE-2026-21385 requires local access, so watch for initial access vectors (phishing, malicious apps) that could precede privilege escalation
  • Restrict sideloading — enforce policies preventing installation from unknown sources to reduce initial access risk
  • Audit Qualcomm chipset exposure — identify which devices in your fleet use affected chipsets and prioritize patching
  • Watch for post-incident indicators — chained exploitation techniques often only surface in forensics long after compromise; proactive threat hunting on mobile endpoints is critical

Read more