Kaspersky Discovers Vulnerability in Qualcomm Snapdragon Chips

Why It Matters

The flaw grants attackers deep, hard‑to‑detect control over billions of devices, threatening user privacy, corporate data, and supply‑chain integrity across the mobile and IoT markets.

Key Takeaways

• Vulnerability resides in Snapdragon BootROM, affecting multiple chip families.
• Physical access of minutes can bypass secure boot and compromise devices.
• Attack impacts smartphones, tablets, automotive, IoT, and supply‑chain security.
• Qualcomm acknowledged CVE‑2026‑25262; patches may be limited for older models.
• Kaspersky demonstrated exploit via Sahara protocol in Emergency Download Mode.

Pulse Analysis

The discovery of a BootROM weakness in Qualcomm Snapdragon chips underscores a growing trend of hardware‑rooted exploits that sidestep traditional software defenses. Unlike firmware bugs that can be patched via OTA updates, BootROM resides in read‑only memory, making remediation complex and often requiring silicon revisions. Analysts note that the Sahara protocol, a low‑level interface for Emergency Download Mode, was an unexpected attack vector, revealing how legacy recovery mechanisms can become backdoors when not hardened against physical tampering.

For enterprises, the vulnerability expands the threat landscape beyond conventional malware. Devices used in critical infrastructure, automotive telematics, and industrial IoT now face a scenario where a brief, physical encounter—such as a device sent for repair or intercepted during logistics—could implant a stealthy implant that survives reboots and firmware updates. This raises supply‑chain security concerns, prompting firms to reassess asset‑tracking, chain‑of‑custody procedures, and to consider hardware‑based attestation solutions that can verify the integrity of the boot chain before granting network access.

Qualcomm’s acknowledgment of CVE‑2026‑25262 signals a willingness to cooperate, yet the patch rollout is likely to be uneven. Older devices may never receive a fix, leaving millions of users exposed. Security vendors are advising immediate mitigations: enforce strict physical control, disable EDL mode where possible, and employ full power loss to clear volatile exploits. In the longer term, the industry may push for more robust secure‑boot architectures and transparent firmware signing, reinforcing the need for a holistic approach that blends hardware design, software updates, and operational security practices.