Critical Android vulnerability CVE-2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-21385 is a memory corruption flaw (CWE-190, integer overflow) in how firmware on a range of Qualcomm Snapdragon chipsets and Qualcomm smart-audio/display platforms handles alignment during memory allocation. It is triggered locally by low-privileged code that performs aligned memory allocations, allowing an attacker running on the device (for example, a malicious app or component) to corrupt memory. Successful exploitation yields high confidentiality, integrity, and availability impact — effectively kernel-level compromise or privilege escalation on the affected device. Affected devices include Android phones built on the listed Snapdragon SoCs (e.g., Snapdragon 429, 4 Gen 1/2, and several 8-series variants) plus Smart Audio 400 and Smart Display 200 platform firmware; Google confirmed it is being exploited in an Android component and shipped a fix in its March 2026 Android security bulletin. The flaw is actively exploited (added to CISA's KEV on 2026-03-03), though no public proof-of-concept is known and ransomware use is unknown.

Do: Patch Android devices to the March 2026 Android security bulletin level (patch level 2026-03-01 or later) or the OEM's equivalent Qualcomm firmware update, prioritizing devices on the listed Snapdragon SoCs; check the installed patch level under Settings > Security > Android security update. Federal/managed environments should follow BOD 22-01 guidance per the CISA KEV entry, and owners of Smart Audio 400 / Smart Display 200-based products should obtain updated firmware from their OEM.