Android Zero Days 2026: Google Flagged 3 CVEs, One Each in Qualcomm, Framework and Pixel Modem Code

Android zero days 2026, as of November 5, 2026: Google’s bulletins have flagged 3 CVEs as possibly under limited, targeted exploitation, against 8 in the same window of 2025. They are CVE-2026-21385 (Qualcomm display), CVE-2025-48595 (Framework) and CVE-2026-58704 (Pixel modem). CISA listed each one day later. The November bulletin flags none.

The complete list: every Android zero day flagged in 2026

Sources: Android Security Bulletins and Pixel Update Bulletins (source.android.com); Samsung Mobile Security SMR bulletins; CISA KEV catalog version 2026.11.04. Bulletin dates are publication dates, not the day a phone received the update. The Android bulletins for January, February, April, May, July, August, September, October and November 2026 carry no note, and neither do the Pixel bulletins other than September.

Where they sit: the component stack

Each layer has a different route to the phone. Of the 44 CVEs Google has flagged since its first note in January 2021, 15 (34%) are in chipset vendor code: 8 Qualcomm and 7 Arm Mali. 10 are in the Linux kernel, 15 in the Android platform and 4 in Pixel-only device code. No Imagination, MediaTek or Unisoc CVE has carried the note, even though all three appear in the 2026 bulletin tables.

One dot per CVE, in the year Google first flagged it. Shaded rows are chipset vendor code. *2026 through November 5, 2026. Hover a dot for the CVE. Sections as named in the bulletin tables; Android Runtime, Framework and System count as platform.

The layer also tells you the patch level to demand. Every one of the 15 chipset CVEs and all 10 kernel CVEs with a table row sit in a -05 or -06 section of the bulletin, not the -01 section. A phone reporting 2026-03-01 has the March date on its settings screen and still lacks CVE-2026-21385. CISA’s KEV entry for that CVE says it directly: “Please check with specific vendors (OEMs,) for information on patching status.”

The chipset share swings. Google flagged 8 chipset CVEs in 2023 and 0 in 2025. That zero does not mean chips were safe in 2025: CISA listed Qualcomm’s CVE-2025-21479, CVE-2025-21480 and CVE-2025-27038 on June 3, 2025, and Google’s August 2025 bulletin carries two of them in its tables with no exploitation note. Adding the 6 chipset CVEs in KEV with 2021 or later IDs and no Google note lifts the chipset count from 15 to 21.

2026 against every year since 2018, same window

Solid bars: CVEs first flagged January 1 to November 5 of each year. Dashed outline: added in the rest of the year. Red: 2026.

The window count is 3 in 2026, 8 in 2025, 5 in 2024, 11 in 2023, 5 in 2022 and 7 in 2021. It was zero from 2018 to 2020, but that is a change in practice, not safety: the first note appears in the January 2021 bulletin. CVE-2019-2215, which Project Zero tracks and CISA lists, is in the October 2019 bulletin with no note. So read this as a record of what Google chose to flag. At 3, 2026 is the lowest window count since notes began.

*2026 is partial. Layer and KEV columns cover the whole year shown. Year is the first date Google flagged the CVE in either bulletin series.

Who ships the fix, and when: Samsung and Pixel

The Android bulletin date is not the patch date, at least at Samsung. We matched every CVE in Samsung’s 2026 SMRs to the first Android bulletin that lists it. In the six months outside Google’s big March and June releases (January, February, April, May, July and August), 168 of 184 CVEs Samsung listed as applied (91%) first appear in a later Android bulletin. Google’s bulletins for February, July and August list no CVEs at all, while Samsung’s SMRs for those months list 25, 39, 38.

in Samsung’s SMR, first in a later Android bulletin other Samsung SMR CVEs CVEs in that month’s Android bulletin

Counts exclude Samsung’s “Already included” and “Not applicable” lists. Samsung’s SVE items and semiconductor patches are not counted.

That head start reached a flagged CVE. Samsung listed CVE-2025-48595 as High in SMR-NOV-2025, seven months before Google’s June 2026 note and CISA’s June 2 listing. By Samsung’s own list, a Galaxy on the November 2025 SMR already had that fix when the CVE made headlines. Samsung is one vendor, and we did not check Xiaomi, OPPO or others, so this does not generalize to Android.

The other clock: when each bulletin is posted

Samsung SMR published Pixel bulletin published KEV federal deadline. Shaded: a month with a flagged CVE

Days after that month’s Android Security Bulletin. The November Pixel bulletin was not posted when we retrieved the pages on November 5, 2026.

Samsung’s 2026 SMRs were posted within 2 days of the Android bulletin every month, and Pixel’s within one day in 7 of 10 months. Pixel’s misses matter. In June 2026 its bulletin came 15 days after the Android bulletin, on June 16, 2026, which was 11 days past the Jun 5 federal deadline for CVE-2025-48595. The September Pixel bulletin, posted 7 days after the Android one, is where CVE-2026-58704 appeared, and Samsung lists the same CVE as a Samsung Semiconductor patch in SMR-NOV-2026, 49 days later. We could not read a dated entry for it on Samsung Semiconductor’s own update page, so 49 days is the gap between the two phone bulletins only.

KEV dates and deadlines

CISA now moves about as fast as the bulletin. All 3 of the 2026 flags reached KEV in one day, and across the 34 flagged since KEV launched on November 3, 2021, the median is 1 day, with 20 listed within two days. 8 were in KEV before the Google note we read: CVE-2024-43093 was listed on November 7, 2024, and the note sits in the March 2025 bulletin. 3 flagged CVEs (CVE-2020-0500, CVE-2022-20415, CVE-2023-21096) have never been listed.

Deadlines tightened during the year. The March CVE got 21 days. The June and September CVEs got 3. CISA’s BOD 26-04, issued June 10, 2026, replaced BOD 22-01, and the September KEV entry cites it. Those dates bind federal civilian agencies only, but they are a usable yardstick: on a 3-day clock, a phone maker’s bulletin date can decide whether a fleet can comply at all. Our analysis of the CISA KEV catalog covers the catalog as a whole, and zero-day statistics by vendor puts Android chips against other vendors.

Explore every flagged CVE since 2021

Gray rows: in CISA’s catalog under Android, Qualcomm, Arm, MediaTek, Samsung mobile or Google Pixel, with no Google note. Year for those rows is the KEV date. Requires JavaScript; the same rows are in the CSV.

The unsupported-version problem

Flagged platform fixes name versions. Google lists CVE-2025-48595 against Android 14, 15, 16 and 16 QPR2. Our report on Android market share by version shows 43.6% of devices in Google’s feed, last updated October 1, 2026, on Android 13 or older, which the current bulletins no longer list. That does not prove those phones are exposed to this CVE: a missing version can mean the flaw does not exist there, or that a maker backported the fix. It does mean no public document says they are safe. Android 14 is the next version at risk of leaving that list: Android 10 to 13 stayed in the bulletins for 39 to 41 months, which would drop Android 14 around January 2027 to March 2027. Google has announced no date.

What this means for MSPs

Set the patch level to the -05 date. In Intune’s Android Enterprise compliance policy, “Minimum security patch level” takes a YYYY-MM-DD date and is empty by default. Use the -05 date of the target month. A floor at the -01 date passes phones missing that month’s chipset fixes, which is where all 15 flagged chipset CVEs sit. Set “Minimum OS version” as well, also empty by default, at Android 14.

Run two floors by device tier. Samsung’s update scope page puts S23 to S26, Fold5 and later, Flip5 and later and the enterprise A54 to A57 on monthly updates, and many other Galaxy A models on quarterly updates, and warns some carriers may support only quarterly updates. A single recent date will mark those phones noncompliant through no fault of the user. Intune takes a fixed date, so keep two policies and move them every month: about 35 days back for monthly devices and about 100 days back for quarterly ones. Move anyone with admin access to a monthly model.

Do not rely on the bulletin date for Pixel. June’s Pixel bulletin lagged the Android bulletin by 15 days and September’s by 7. If a client uses Pixels, read the Pixel bulletin rather than the Android one, because that is where CVE-2026-58704 appeared, and the Android bulletin never mentioned it. Keep the check in the monthly patch report.

Watch KEV’s chipset entries, not just the note. CVE-2025-21479 is in Samsung’s SMR-MAY-2025, in CISA’s catalog from June 3, 2025 and in Google’s August 2025 bulletin, with no note. Add KEV’s Qualcomm, Arm and Samsung entries to the same watch list as the Android note, because the note alone would have missed it.

Write the response step. For a flagged CVE, the MDM can answer one question within minutes: how many phones are below the required patch level. Run that report on the day of the bulletin and again on the KEV deadline. Phones that cannot reach the level should lose access to company data through the same compliance policy, rather than a ticket that waits.

Frequently asked questions

How many Android zero days have there been in 2026?

3 as of November 5, 2026, counting CVEs Google’s Android and Pixel bulletins flag as possibly under limited, targeted exploitation. They are CVE-2026-21385, CVE-2025-48595 and CVE-2026-58704. The same window of 2025 had 8, and 2025 finished at 10. This count is a floor: 23 Android-ecosystem CVEs in CISA’s catalog never got a Google note.

Is CVE-2026-21385 patched on Samsung phones?

Samsung’s SMR-MAR-2026 bulletin, published March 3, 2026, lists CVE-2026-21385 as a High item, one day after Google’s bulletin. That is the bulletin date. Samsung’s update scope page puts many Galaxy A models on quarterly updates, and says some carriers may support only quarterly updates, so check the installed patch level on each phone.

Which patch level fixes the Android zero days of 2026?

CVE-2026-21385 needs 2026-03-05 or later, because Google lists it in the -05 section. CVE-2025-48595 is in the 2026-06-01 section. CVE-2026-58704 is in the September 2026 Pixel bulletin, where Google says patch level 2026-09-05 or later fixes the issues. All 15 chipset CVEs Google has flagged since 2021 sit in a -05 section, so a phone showing the -01 date of that month lacks them.

How long does it take CISA to add an Android zero day to KEV?

All 3 in 2026 were listed one day after Google flagged them. For the 34 flagged CVEs since KEV launched in November 2021, the median gap is 1 day, and 8 were in KEV before Google’s note. 3 flagged CVEs have never been listed. Federal deadlines in 2026 were 21 days for the March CVE and 3 days for the June and September CVEs.

My phone no longer gets security updates. What should I do?

Replace it, or move company data off it. CVE-2025-48595 is listed against Android 14, 15, 16 and 16 QPR2 only, and 43.6% of devices in Google’s feed last updated October 1, 2026 run Android 13 or older. Phone makers can backport fixes, but no public list shows it. If your maker’s update page no longer names your model, treat it as unpatched.

How do I avoid Android zero-day exploits?

Install updates and enforce the patch level. In the flagged set, 15 of 44 sit in chipset code and 10 in the kernel, and neither can be fixed by an app, a browser update or a mobile security product. They arrive only in the phone maker’s firmware. Set a minimum patch level in your MDM, and use the -05 date of the target month.

Methodology

References

1. Android Open Source Project, Android Security Bulletins overview, including March 2026, June 2026 and November 2026. Accessed November 2026.
2. Android Open Source Project, Pixel Update Bulletins, including June 2026 and September 2026. Accessed November 2026.
3. Samsung Mobile Security, Android security updates (SMR bulletins). Accessed November 2026.
4. Samsung Mobile Security, security update scope. Accessed November 2026.
5. CISA, Known Exploited Vulnerabilities Catalog (JSON feed). Accessed November 2026.
6. CISA, Binding Operational Directive 26-04. Accessed November 2026.
7. Google Project Zero, “0day In the Wild” tracking spreadsheet. Accessed October 2026.
8. Google, Android Studio distribution feed. Accessed November 2026.
9. Microsoft Learn, Android Enterprise compliance settings in Intune. Accessed November 2026.
10. SOC Prime, CVE-2026-21385 coverage and SecurityWeek, June 2026 Android update (bulletin count comparison only). Accessed November 2026.