Back Cybersecuritynews

Critical MediaTek Vulnerability Lets Attackers Steal Android Phone PINs in 45 Seconds

Cybersecuritynews •Guru Baran • March 12, 2026

A critical vulnerability in the MediaTek Dimensity 7300 chipset allows a physical attacker to extract device PINs, decrypt on-device storage, and steal cryptocurrency wallet seed phrases in approximately 45 seconds, raising serious alarms for the roughly 25% of Android users whose devices rely on the affected chip. The vulnerability uncovered by Ledger’s Donjon security research […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MediaTek Chip Vulnerability Exposes 25% of Android Phones to Data Theft A critical vulnerability affecting MediaTek processors in Android smartphones allows attackers to extract sensitive user data, including PINs and cryptocurrency wallet seed phrases, in under 45 seconds. Discovered by Ledger's Donjon security team, the flaw exploits weaknesses in the secure boot chain of affected devices, enabling unauthorized access via a USB connection. This vulnerability could impact approximately 25% of Android phones globally, particularly those utilizing Trustonic's Trusted Execution Environment (TEE). The issue has been publicly disclosed as CVE-2026-20435, and MediaTek has issued a firmware patch to device manufacturers. Users are advised to ensure their devices are updated with the latest security patches to mitigate risks. The vulnerability has been present for potentially a decade without prior detection. Ledger's CTO emphasized the need for improved security in smartphones, which are often not designed to safeguard sensitive data effectively. 23 sources 71

Extracted Entities

Critical MediaTek Vulnerability Lets Attackers Steal Android Phone PINs in 45 Seconds

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)