Summary

Google has disclosed a high-severity security vulnerability, CVE-2026-21385, in a Qualcomm component used in Android devices, which is being actively exploited in the wild.

Key Points

• The vulnerability is identified as CVE-2026-21385 with a CVSS score of 7.8.
• It is a buffer over-read issue in the Graphics component of Qualcomm's open-source software.
• The flaw results from memory corruption due to improper handling of user-supplied data.
• Google confirmed the active exploitation of this vulnerability on March 2026.
• Qualcomm has issued an advisory regarding this security flaw.

Analysis

The active exploitation of CVE-2026-21385 highlights the critical need for timely patching and monitoring of vulnerabilities in widely-used components like those from Qualcomm. Given the high CVSS score of 7.8, this vulnerability poses a significant risk to Android devices, potentially leading to unauthorized access or data breaches.

Conclusion

IT professionals should prioritize applying patches for CVE-2026-21385 on affected Android devices and monitor for any unusual activity that may indicate exploitation attempts.