Critical Security Flaw Affects 30 Percent of Android Devices With Qualcomm Chips

Security researchers have uncovered a significant vulnerability within Qualcomm's modem technology, impacting a large portion of the Android ecosystem. This flaw, identified by Check Point Research, stems from the Mobile System Modem (MSM) component that has existed in Qualcomm chips since the 1990s. Hackers can exploit it simply by sending a specially crafted SMS message, gaining access to sensitive device functions such as reading messages, viewing call history, and unlocking the SIM card.

The vulnerability remains present even in modern 5G-capable Qualcomm chipsets used by major manufacturers including Samsung, Xiaomi, OnePlus, and Oppo. Upwards of 30% of all Android phones rely on Qualcomm modem software containing this weakness. Devices that fail to receive regular security patches are particularly at risk.

Qualcomm confirmed awareness of the issue and released patches to OEMs in December 2020, urging users to update their devices when available. However, the flaw's identification number, CVE-2020-11292, does not appear in recent Android security bulletins, suggesting it may have been addressed quietly in prior updates. Samsung has already implemented fixes for many Galaxy models. The issue will be publicly acknowledged in the June 2021 security update.

Given the fragmented nature of Android updates, many users may wait months for protection. Only a small number of manufacturers consistently deliver timely security patches, leaving most Snapdragon-powered phones exposed until updates arrive.