Google released security updates on Monday that patch 129 Android vulnerabilities, including an actively exploited zero day in a Qualcomm display component, a security bulletin from Google said.
KEY FACTS
- Incident Active zero day in a Qualcomm display component under limited targeted exploitation
- Vulnerabilities 129 Android security flaws patched, 10 rated critical
- Technical cause Integer overflow in Graphics subcomponent can lead to memory corruption
- Patches Two patch levels published, 2026-03-01 and 2026-03-05
The vendor was alerted to the display flaw on December 18 by Google’s Android Security team and customers were notified on February 2. The flaw affects 235 chipsets.
An integer overflow in the Graphics subcomponent can allow local attackers to trigger memory corruption, according to the Qualcomm security advisory.
The bulletin also fixed 10 critical vulnerabilities in System, Framework, and Kernel components that can enable remote code execution, privilege escalation, or denial of service. The most severe is a critical System vulnerability that can lead to remote code execution without additional privileges and without user interaction.
Two security patch levels are included, labeled 2026-03-01 and 2026-03-05. The later patch level bundles fixes for closed source third party and kernel subcomponents that may not apply to all devices. Pixel devices receive updates immediately while other vendors often take longer to test and adapt patches.
WHY IT MATTERS
The updates address flaws that can allow attackers to run code or crash devices and that are already under limited exploitation. Users and device operators should apply vendor updates quickly, especially on devices with affected chipsets.