March 2026 Android Security Updates Address Critical Vulnerability

Google has released the Android Security Bulletin for March 2026, detailing security vulnerabilities addressed in the mobile operating system. The update is structured in two phases to expedite the implementation of critical fixes by manufacturers.

Two-Tiered Patch System

The March 2026 security update is divided into two patch levels. Devices receiving patch level 2026-03-01 will receive corrections for the Android framework and system components. The second patch level, 2026-03-05, includes all previous fixes, along with specific patches for kernel components and third-party hardware drivers.

Critical Remote Code Execution Vulnerability

A critical vulnerability has been identified within the system component, potentially allowing attackers to execute malicious code remotely without user interaction. Google classifies this vulnerability as critical due to the lack of required execution privileges.

Qualcomm Vulnerability Under Targeted Exploitation

There are indications that the vulnerability CVE-2026-21385, affecting Qualcomm display components, is already being exploited in a limited and targeted manner. Device manufacturers are urged to promptly release the patch to mitigate this risk.

Component-Specific Patches

The 2026-03-05 patch level includes fixes for various components from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm.

AOSP Source Code Release Changes

Since the beginning of 2026, Google has transitioned to releasing the Android Open Source Project (AOSP) source code in the second and fourth quarters to enhance platform stability. Developers are now advised to use the android-latest-release branch instead of aosp-main for the most up-to-date releases. Patches for the March bulletin are expected to be available in the repository within 48 hours.

Pixel and Manufacturer Rollout

Pixel users are likely to receive the updates promptly. However, the rollout schedule for other manufacturers will depend on their individual update commitments.

Android Developer Verification Program Changes

Starting in September 2026, Google will require all Android app developers to register before distributing APKs. This new Android Developer Verification program is facing pushback from nearly 50 organizations concerned about its impact on sideloading and alternative app stores. The program requires a registration fee, government-issued identification, and submission of private signing keys and application identifiers. More information on the program can be found here.

Android 17 Beta Release

The second beta for Android 17 is slated to arrive in March, with a full stable release, referred to as the Android 17 Platform Release (26Q2), expected by the complete of the second quarter of 2026. Read more about the Android 17 release timeline here.

Read the full Android Security Bulletin for March 2026.