There are currently no details on how the vulnerability is being exploited in the wild. However, Google acknowledged in its monthly Android security bulletin that “there are indications that CVE-2026–21385 may be under limited, targeted exploitation.”
Google’s March 2026 update contains patches for a total of 129 vulnerabilities, including a critical flaw in the System component (CVE-2026–0006) that could lead to remote code execution without requiring any additional privileges or user interaction. In contrast, Google addressed one Android vulnerability in January 2026 and none last month.
Also patched by Google are multiple critical-rated bugs: a privilege escalation bug in Framework (CVE-2026–0047), a denial-of-service (DoS) in System (CVE-2025–48631), and seven privilege escalation flaws in Kernel components (CVE-2024–43859, CVE-2026–0037, CVE-2026–0038, CVE-2026–0027, CVE-2026–0028, CVE-2026–0030, and CVE-2026–0031).










