Google confirms that the Qualcomm Android vulnerability CVE-2026-21385 was exploited in real-world attacks.
Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited.
“There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory.
The flaw is a buffer over-read in the Graphics component that could allow attackers to access sensitive memory data, underscoring ongoing risks to Android users.
The company did not disclose technical details about the attacks exploiting this vulnerability.
“Integer Overflow or Wraparound in Graphics” reads the Qualcomm advisory. “Memory corruption while using alignments for memory allocation.”
Qualcomm received a report about CVE-2026-21385 from Google’s Android Security team on December 18, 2025, and notified customers on February 2, 2026. Google says it sees signs of limited, targeted exploitation, though it has not shared technical details. The March 2026 Android update fixes 129 vulnerabilities, including the critical CVE-2026-0006, which allows remote code execution without user interaction or additional privileges.
Android Security Bulletin March 2026 addressed the following critical flaws:
Framework CVE-2026-0047 (CVSS score of 8,8) – Critical Framework Elevation of Privilege, local privilege escalation without extra privileges; no user interaction needed.
System CVE-2026-0006 (CVSS score of 9,8) – Critical System Remote Code Execution, remote code execution without privileges; no user interaction; most severe issue. CVE-2025-48631 (CVSS score of 8,6) – Critical System Denial of Service, causes device/service denial; no extra privileges needed.
Kernel CVE-2024-43859 (CVSS score of 8,8) – Critical Kernel Elevation of Privilege in Flash-Friendly File System, local file system privilege escalation. CVE-2026-0037 (CVSS score of 9,0) – Critical protected Kernel-based Virtual Machine Elevation of Privilege, breaks virtual machine isolation with System privileges. CVE-2026-0038 (CVSS score of 9,0) – Critical Hypervisor Elevation of Privilege, potential virtual machine escape to host control. CVE-2026-0027 (CVSS score of 9,0) – Critical protected Kernel-based Virtual Machine Elevation of Privilege, kernel virtualization privilege escalation. CVE-2026-0028 (CVSS score of 9,0) – Critical protected Kernel-based Virtual Machine Elevation of Privilege, local attacker escalates in protected virtual machines. CVE-2026-0030 (CVSS score of 9,0) – Critical protected Kernel-based Virtual Machine Elevation of Privilege, high-impact virtualization isolation bypass. CVE-2026-0031 (CVSS score of 9,0) – Critical protected Kernel-based Virtual Machine Elevation of Privilege, escalates privileges across virtual machine boundaries.
Google’s Android security bulletin introduces two patch levels, 2026-03-01 and 2026-03-05, to help device makers roll out fixes more quickly across different models. The later patch level adds updates for
Modularity was one of the most exciting phone trends of the 2010s. It promised phones that would work like desktop PCs, allowing owners to upgrade individual components, add new functionalities, and replace broken parts with ease, improving longevity and ushering in a new, sustainable smartphone era.
While its early days looked promising thanks to pioneers like Modu, which launched the first modular phone in 2008, Google’s Project Ara, and Motorola’s Moto Z lineup, the modularity dream ultimately fizzled out. But not before begetting a few exciting modular phones that captured our attention, if nothing else.
1
Google Project Ara
Credit: Google
After Google acquired modular phone-related patents from Modu, which closed its doors in 2011, Google and Motorola, which Google bought in 2011, began exploring the modular phone concept in 2012. Google Project Ara officially kicked off in 2013, with the design philosophy based on Dave Hakkens’ Phonebloks concept.
The original idea was for Google/Motorola to produce the phone’s base, the so-called “Endo” (exoskeleton) frame, with third-party vendors providing everything else, from displays to cameras to batteries. Modules would attach to the phone via an innovative magnetic mechanism with hot swap support.
Credit: Google
The dream was to provide a modular phone where almost everything would be easily replaceable and upgradable. Google had to walk back some of the original design choices, such as the ability to replace the screen and the SoC, due to hardware limitations, but the project didn’t abandon its promise of modularity.
Sadly, after three years of development, Google pulled the plug on Project Ara in September 2016, citing high costs and manufacturing issues. Project Ara (kind of) lived on in Motorola’s Moto Mods, but we’ve never gotten a proper Project Ara modular smartphone.
A crying shame because the college me had his mind blown by the whole modular phone movement of the 2010s. Even today, I’d love nothing more than to play around with Project Ara prototypes, if only for a few minutes.
2
LG G5
Credit: LG Mobile
LG had a few Android hits back in the early 2010s. The LG G2 is still one of the prettiest Android phones ever, and it sold quite well. The G3 ironed out its predecessor’s kinks while keeping up its sales momentum. But the upward trajectory stalled with the LG G4, so the Korean giant decided to shake up its flagship series.
Enter the LG G5, one of LG’s most ambitious phones ever. The phone’s bottom segment was removable, allowing owners to quickly install modules LG touted as “Friends,” which included various extra functionalities. You had a high-end DAC and Amp, a module that packed extra battery capacity and additional camera controls, and a module with a replaceable battery, allowing you to swap in a new one in a jiff.
Credit: LG
While the phone piqued the attention of smartphone enthusiasts, myself included, sales showed that the mainstream audience wasn’t exactly engrossed by the concept. Ultimately, the LG G5 had disappointing sales numbers, and LG abandoned its “friends” modular add-ons ecosystem shortly after, with the G5 staying the only modular phone in LG’s lineup.
Credit: Lucas Gouveia/How-To Geek | Essential Products
The Essential Phone had a lot going for it even before it hit the shelves. The brainchild of Andy Rubin, the father of Android, the phone created quite a buzz in the tech world back when it was announced in the spring of 2017. Its bold design, which debuted the notch, ditched the 3.5mm headphone jack, and made the two camera lenses flush with the phone’s slick ceramic back, was a head turner.
Early promotional photos showed the phone with a camera module attached. It was later revealed that the Essential PH-1 features a magnetic Click Connector on the upper right of its back. The connector allowed the PH-1 to be used with custom-made modules, and while Essential only provided one module at launch, the 360° camera, it promised more modules further down the road.
Credit: Essential
Alas, the Essential PH-1 didn’t sell that well, even after receiving a $200 price reduction shortly after launch. This affected Essential’s promise of modularity. Ultimately, we only got one extra module that incorporated a headphone jack and a high-end DAC. While the PH-1 had a lot of promise (I loved its vanilla Android experience, modularity, and flush design), it didn’t pan out. Its successor, the Essential PH-2, was canceled, we never got new modules, and Karl Pei’s Nothing bought the Essential brand in 2021.
4
Motorola Moto Z
Credit: Motorola
Motorola’s Moto Mods modular ecosystem is, hands down, the most well-received, popular, and longest-lived modular phone undertaking in history. It all started in 2016 with the release of the Motorola Moto Z, one of the thinnest phones of all time and a real looker even by modern standards.
Drawing on experience from working on Google’s Project Ara, Motorola’s engineers developed a magnetic attachment system powered by pogo pins that used barely any space on the Moto Z’s slender body. The phone arrived with a wide selection of Moto Mods, including a power bank, a great-sounding JBL speaker, as well as more exotic add-ons such as a projector and a full-fledged point-and-shoot camera with a 10x zoom.
Credit: Motorola
Unlike other modular phone projects, Motorola provided a wide selection of Moto Mods at launch and greatly expanded the offering over the years. The company supported Moto Mods across four generations of Moto Z devices, with a total of 7 phones compatible with modular add-ons. Even some community-developed Moto Mods projects saw the light of day, like the slide-out keyboard mod.
Unfortunately, the Moto Mods project was abandoned in 2019, with the Moto Z4 being the last modular handset from Motorola. Despite its demise, Moto Mods left the deepest mark on the promise of modularity in Android, which still (kind of) lives on.
While not as exciting as other phones on this list, the Fairphone series of Android smartphones is the closest thing we’ve gotten to Google’s Project Ara. Aside from the original Fairphone, every member of the Fairphone family is an easy-to-repair, modular Android phone.
Instead of extra features, modular parts in Fairphone devices are there to allow for a high degree of repairability. They include the display, camera module with interchangeable lenses, an easy-to-replace battery, the SoC module, and modular daughterboards and flex cables.
Credit: Fairphone
They’re straightforward to remove and reattach, allowing owners to repair their phones by themselves from the comfort of their home. All you need are some screwdrivers and tweezers, spare parts you can order directly from the Fairphone spare parts shop, and you’re off to the races.
Despite being one of the easiest phones to repair, the latest Fairphone offering—the Fairphone 6—is anything but popular. It’s a niche device that the mainstream audience, as well as many enthusiasts, aren’t interested in, because being fully modular entails certain compromises (a plastic body, a mid-range chipset, cameras that trail high-end options, and more) that most phone users don’t want to deal with.
While the promise of modularity was exciting in the 2010s, the cold, harsh truth is that most of us will always choose high-end features and hard-to-repair unibody designs over sustainable, repairable modular phones.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.