MediaTek Chip Vulnerability Exposes 25% of Android Phones to Data Theft

A critical vulnerability affecting MediaTek processors in Android smartphones allows attackers to extract sensitive user data, including PINs and cryptocurrency wallet seed phrases, in under 45 seconds. Discovered by Ledger's Donjon security team, the flaw exploits weaknesses in the secure boot chain of affected devices, enabling unauthorized access via a USB connection. This vulnerability could impact approximately 25% of Android phones globally, particularly those utilizing Trustonic's Trusted Execution Environment (TEE). The issue has been publicly disclosed as CVE-2026-20435, and MediaTek has issued a firmware patch to device manufacturers. Users are advised to ensure their devices are updated with the latest security patches to mitigate risks. The vulnerability has been present for potentially a decade without prior detection. Ledger's CTO emphasized the need for improved security in smartphones, which are often not designed to safeguard sensitive data effectively.

Key Points: • Vulnerability allows data extraction from Android phones in under 45 seconds. • Approximately 25% of Android devices using MediaTek chips are affected. • MediaTek has released a firmware patch to address the vulnerability.