MediaTek Security Flaw Exposes Millions of Android Devices to Data Theft
A critical security vulnerability affecting millions of Android devices powered by MediaTek processors has been discovered, allowing attackers to extract sensitive user data even when the device is powered off. The flaw, impacting devices utilizing Trustonic’s Trusted Execution Environment (TEE), was demonstrated by security researchers from Ledger’s Donjon team, who compromised a Nothing CMF Phone 1 in under 45 seconds.
The Vulnerability: A Boot Chain Weakness
The vulnerability resides in the boot chain – the process that verifies system integrity during device startup. Researchers were able to bypass this security mechanism before the Android operating system fully loaded. This allowed them to gain access to protected data with a simple USB connection and specialized software, requiring no malware installation or user interaction.
Data at Risk: PINs, Storage, and Crypto Wallets
Exploiting this flaw grants attackers access to a user’s PIN code, decrypts the device’s storage, and, critically, extracts master keys for cryptocurrency wallets. This poses a significant risk to users storing digital assets on affected devices. The stolen cryptographic keys can be used to decrypt copied data.
Affected Devices and Chipsets
The vulnerability impacts a wide range of MediaTek processors, potentially affecting a substantial portion of the Android market. The following chipsets are known to be affected:
- MT2737 (Helio A22)
- MT6739 (MediaTek MT6739)
- MT6761 (Helio A22)
- MT6765 (Helio P35/G35)
- MT6768 (Helio P65/G85)
- MT6781 (Helio G96)
- MT6789 (Helio G99)
- MT6833 (Dimensions 700/810)
- MT6853 (Dimensity 720/800U)
- MT6855 (Dimensions 930/7020)
- MT6877 (Dimensions 900/1080)
- MT6878 (Dimensions 7050)
- MT6879 (Dimensions 1300)
- MT6880 (Dimensions 8000)
- MT6885 (Dimensity 1000L)
- MT6886 (Dimensions 7200)
- MT6889 (Dimension 1000+)
- MT6890 (Dimensions 1000)
- MT6893 (Dimensions 1200)
- MT6895 (Dimensions 8100)
- MT6897 (Dimensions 8200)
- MT6983 (Dimensions 9000)
- MT6985 (Dimensions 9000+)
- MT6989 (Dimensions 9300)
- MT6990 (Dimensions 9200)
- MT6993 (Dimensions 9400)
Patch Availability and Update Rollout
MediaTek issued a fix for the vulnerability (CVE-2026-20435) to device manufacturers in January 2026. However, the effectiveness of this fix relies on timely software updates from individual device manufacturers. Lower-cost devices and older models may not receive updates, leaving them vulnerable. MediaTek states that newer processors are hardware-resistant to this type of attack.
Mitigation and Recommendations
Until updates are available, users with MediaTek-powered Android devices should exercise caution and avoid leaving their devices unattended. The vulnerability highlights the inherent security limitations of smartphones and the importance of a robust and timely update process.
Sources: