Patch days / March 2026

Android Security Bulletin — March 2026

Monday, 2 March 2026

Vulnerabilities: 57
Critical: 3
High: 43
Zero-days: 0
Public exploit: 6

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

Critical 9.8
CVE-2026-0006 Public exploit In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additio…
Critical 9.8
CVE-2025-48645 In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of pri…
Critical 9.1
CVE-2025-48609 In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a pa…

Public exploit code 5

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

All vulnerabilities 57

Critical3 Show

High43 Show

Medium11 Show