Qualcomm CVE-2026-24090: Brief Summary of a Boot Flow Cryptographic Bypass Affecting Dozens of Snapdragon Chipsets

Introduction

A missing cryptographic authentication check in Qualcomm's Application Bootloader allows a locally authenticated attacker to tamper with partition table entries and redirect the device boot flow, potentially loading unauthorized code on dozens of Snapdragon chipset families. CVE-2026-24090 was disclosed in the Qualcomm June 2026 security bulletin with a CVSS score of 7.1. It affects a broad swath of premium mobile, AR/XR, wearable, and automotive platforms, and other Qualcomm boot chain vulnerabilities have already been confirmed exploited in targeted attacks.

Technical Information

Root Cause: Missing Authentication in Partition Table Processing

CVE-2026-24090 is in Qualcomm's Application Bootloader (ABL), which is built on the tianocore/edk2 UEFI framework and falls in the HLOS (High Level Operating System) technology area. It is classified as CWE-306: Missing Authentication for Critical Function, which MITRE defines as occurring when "the product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources."

During device boot, the ABL processes partition table entries to decide which boot components to load. It uses the EDK2 GetBlkIOHandles function to scan the GUID Partition Table (GPT) for partitions with specific ASCII labels. When it finds a viable EFI System Partition, the ABL reads the raw block device contents and passes them to the standard gBS->LoadImage() UEFI service. The ABL performs no cryptographic authentication check on the partition table entries before the boot flow commits to loading the identified components.

An attacker with local device access and only basic user privileges can therefore modify partition table entries to redirect the boot flow, so that the ABL loads unauthorized code instead of the legitimate boot components.

CVSS Vector Breakdown

The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N breaks down as follows:

Because the attack is local and needs only low privileges, any application running on the device with basic permissions could trigger exploitation. High confidentiality and integrity impact with no availability impact fits a boot flow modification, where an attacker can read and modify boot components while the device keeps running. That makes the compromise harder to detect.

Architectural Context: UEFI Platform Key Failures

In a related analysis of a Qualcomm bootchain vulnerability on the Snapdragon 8 Elite Gen 5, researchers demonstrated that OEMs shipped retail devices with the UEFI Platform Key (PK) entirely unpopulated in Authenticated Variable Storage. The missing PK forces the EDK2 AuthVariableLib to move the firmware from User Mode into an unauthenticated Setup Mode, where the DxeImageVerificationLib handler bypasses all Authenticode and RSA signature checks.

That analysis covers a different CVE, but it shows the same failure pattern behind CVE-2026-24090: cryptographic verification is missing during partition processing in the boot chain. A complete exploit chain has already been demonstrated against this class of vulnerability on the same platform family, which raises the practical risk of CVE-2026-24090.

Sibling Vulnerability: CVE-2026-24088

The same June 2026 Qualcomm security bulletin also lists CVE-2026-24088, a related, higher-severity vulnerability that is also classified under CWE-306. CVE-2026-24088 has a CVSS score of 8.2 and is described as a "Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader."

Both vulnerabilities share the same root cause and should be patched together. Fixing one without the other leaves an adjacent attack path open.

OEM Notification and Patch Latency

Qualcomm patched the issue in the ABL (tianocore/edk2) repository and notified OEMs on March 2, 2026. The NVD did not publish the record until June 1, 2026, which left a roughly three-month window in which OEMs had the patch and end users likely did not. The NVD entry still reads "NVD assessment not yet provided," and NIST has not assigned a CVSS score, so organizations should use the Qualcomm-assigned CVSS 7.1 score for severity triage.

Affected Systems and Versions

The Qualcomm June 2026 bulletin lists the following chipset families as potentially affected, and notes that "the list of affected chipsets may not be complete":

Snapdragon Mobile: Snapdragon 4 Gen 1, Snapdragon 4 Gen 2, Snapdragon 460, Snapdragon 6 Gen 1, Snapdragon 6 Gen 3, Snapdragon 6 Gen 4, Snapdragon 662, Snapdragon 7 Gen 4, Snapdragon 7s Gen 3, Snapdragon 8 Elite, Snapdragon 8 Elite Gen 5, Snapdragon 8 Gen 2, Snapdragon 8 Gen 3, Snapdragon 8+ Gen 2

Snapdragon AR/XR: AR1 Gen 1, AR1+ Gen 1, XR2 Gen 1, XR2+ Gen 1

Snapdragon Wear: Wear Elite

FastConnect: FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800

Qualcomm Video Collaboration: VC1, VC3, VC5

Additional platforms: Various automotive and compute chipsets (specific model numbers listed in the Qualcomm bulletin)

The flaw is in the Application Bootloader (ABL) component built on the tianocore/edk2 UEFI framework. Until the OEM firmware update is applied, treat every device running the affected ABL firmware on the listed chipsets as vulnerable.

Vendor Security History

Qualcomm's boot chain and firmware have drawn repeated attention from security researchers and threat actors.

CVE-2026-21385, a Qualcomm zero-day, was confirmed exploited in targeted Android attacks and added to the CISA Known Exploited Vulnerabilities catalog with an exploitation date of March 3, 2026. Qualcomm boot and firmware vulnerabilities are actively targeted in the wild.

A bootchain zero-day analysis published in March 2026 demonstrated a complete three-stage autonomous exploit chain against the Snapdragon 8 Elite Gen 5. The chain used missing UEFI Platform Key enforcement to achieve a permanent, undetectable bootloader unlock. The analysis found that OEMs had shipped devices with unpopulated Platform Keys, which effectively disabled UEFI Secure Boot.

Public proof-of-concept exploit code for Qualcomm bootchain vulnerabilities is available on platforms such as Sploitus, which lowers the barrier to exploiting similar weaknesses.

Security researcher "VoidTato" reported CVE-2026-24090 to Qualcomm on December 15, 2025. The roughly 5.5-month gap between the December 2025 report and the June 2026 publication suggests Qualcomm followed a coordinated disclosure process that gave OEMs time to integrate the patch before public disclosure.

Qualcomm holds approximately 24.7% of global smartphone chipset shipments in 2026 and dominates the premium and flagship tiers. Flagship Snapdragon processors are standard in high-value enterprise and government mobile devices, so CVE-2026-24090 affects those devices disproportionately.

References

• NVD: CVE-2026-24090
• Qualcomm June 2026 Security Bulletin
• CWE-306: Missing Authentication for Critical Function
• NVD: CVE-2026-21385
• CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Attacks
• Qualcomm Bootchain Zero-Day: UEFI, GBL and The Android Exploit Chain
• Qualcomm AVB Exploit PoC on Sploitus
• CISA Known Exploited Vulnerabilities Catalog
• EDK II CVE Information
• Qualcomm Product Security
• Android Security Bulletin: June 2026