Google released an Android update fixing 129 vulnerabilities, including a zero-day flaw linked to Qualcomm chips already exploited in attacks.