Quick Look: CVE-2026-25276, Qualcomm StrongBox Bounds Check Bypass Threatens Hardware Root of Trust

Introduction

A missing bounds check in Qualcomm's StrongBox Secure Processor firmware means that the very component designed to be the hardware root of trust on Android devices can be turned against them. CVE-2026-25276 carries a CVSS 8.8 Critical rating with a Scope Changed designation. That means exploitation inside the isolated Secure Processing Unit can carry impact into the host Android operating system, which undermines the security boundary StrongBox exists to enforce.

The vulnerability affects a sprawling list of over 40 Qualcomm chipsets, from current flagships like the Snapdragon 8 Elite down to legacy platforms like the Snapdragon 865 5G, along with connectivity, audio, and industrial components. Given Qualcomm's approximately 24.7% share of the global smartphone chipset market and its dominance in the premium Android segment, the potential blast radius spans hundreds of millions of devices across dozens of OEMs.

Technical Information

Root Cause: CWE-129 in the Secure Processor

CVE-2026-25276 is classified under CWE-129: Improper Validation of Array Index, which MITRE defines as occurring when "the product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index." Here, the StrongBox firmware in Qualcomm's Secure Processing Unit (SPU) fails to validate an array index before using it, which allows an out-of-bounds memory access that corrupts memory.

Understanding StrongBox and the SPU

StrongBox is Android's implementation of a hardware-backed keystore, exposed through the StrongBox KeyMint (previously Keymaster) interface. It runs on a dedicated secure element: a separate, isolated microprocessor in the device, built to store sensitive data and execute cryptographic operations in a highly secure environment. On Qualcomm Snapdragon platforms, StrongBox runs inside the Qualcomm Secure Processing Unit (SPU), which is hardware-isolated from both the main application processor and the Trusted Execution Environment (TEE). The SPU handles cryptographic key generation, storage, and operations including attestation, signing, and encryption.

A memory corruption bug in a regular application is one thing. A memory corruption bug in the component that guards every hardware-backed cryptographic key on the device is categorically different.

CVSS Vector Breakdown

The full CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which scores 8.8:

The Scope Changed (S:C) designation means the vulnerability's impact crosses a trust boundary. Exploitation inside the Secure Processor, which is a separate security authority, can compromise resources governed by the host Android OS. A local attacker who exploits this StrongBox flaw could escalate from the isolated secure world into the rich execution environment.

Attack Flow

Based on the CWE-129 classification and the vulnerability description, the exploitation path follows these steps:

1. The attacker gets local access to the device, for example through a malicious application, physical access, or a prior compromise. Low privileges are enough (PR:L), so the attacker does not need root or administrative access.

2. The attacker supplies or influences an array index value that reaches StrongBox without proper bounds validation. Since StrongBox processes cryptographic operations, the index may relate to key slot selection, operation dispatch tables, or internal buffer management within the SPU.

3. The unchecked index causes an out-of-bounds memory access inside the Secure Processor and corrupts memory. Depending on whether the access is a read or a write, this could lead to information disclosure, arbitrary code execution within the SPU, or both.

4. Because the SPU shares certain interfaces and data with the host OS (key material, attestation responses, cryptographic operation results), corrupting SPU memory can carry impact into the Android OS. An attacker could then extract cryptographic keys, forge attestation certificates, or bypass hardware-backed security guarantees.

No user interaction is required (UI:N) and attack complexity is low (AC:L), which indicates that once an attacker has local access, exploitation is straightforward and reliable.

Companion Vulnerability: CVE-2026-25277

The same Qualcomm June 2026 bulletin discloses CVE-2026-25277, a second Critical vulnerability in the Secure Processor StrongBox component, with an identical CVSS score of 8.8 and the same affected chipset list. Where CVE-2026-25276 is a missing bounds check (CWE-129), CVE-2026-25277 is a buffer overflow classified under CWE-120: Buffer Copy Without Checking Size of Input. Two Critical StrongBox vulnerabilities with different root causes in the same patch cycle suggest a systemic weakness in how StrongBox validates input, rather than one isolated coding error. Fixing only the code paths named in each CVE may leave similar unreported weaknesses in adjacent code.

Patch Information

Qualcomm has addressed CVE-2026-25276, and the fix is acknowledged in both the Qualcomm June 2026 Security Bulletin and the Android Security Bulletin for June 2026, published on June 1, 2026.

The fix is closed-source and proprietary, so there is no public source code commit or diff to inspect. Because the vulnerability lives in Qualcomm's proprietary Secure Processor firmware, the fix ships to OEMs as an updated binary driver rather than as an AOSP source code patch. In the Android Security Bulletin, the entry's Android bug reference A-500022090 carries an asterisk (*), which Google uses to mark updates contained in the latest proprietary binary drivers. Drivers for Pixel devices are available from the Google Developer site.

The patch is gated behind the 2026-06-05 Android security patch level. Any device reporting a security patch level of 2026-06-05 or later includes the fix. Qualcomm notified OEM customers about this vulnerability on April 6, 2026, which gave partners roughly two months of lead time before the public bulletin.

Qualcomm discovered the vulnerability internally (the "Date Reported" field reads "Internal"), so it did not come from an external researcher. The Qualcomm bulletin states that patches are being actively shared with OEMs and that they are "strongly recommended to deploy those patches on released devices as soon as possible."

Organizations should check that every Qualcomm-powered Android device in their fleet runs at least the 2026-06-05 patch level. CVE-2026-25276 and CVE-2026-25277 affect the same StrongBox component, with the same CVSS score and affected chipset list, so confirm that the patches you apply cover both vulnerabilities.

Affected Systems and Versions

The Qualcomm June 2026 Security Bulletin confirms that CVE-2026-25276 affects the following chipsets:

Flagship Mobile Platforms

• Snapdragon 8 Gen 2
• Snapdragon 8 Gen 3
• Snapdragon 8+ Gen 2
• Snapdragon 8 Elite
• Snapdragon 8 Elite Gen 5

Legacy Flagship Platforms

• Snapdragon 865 5G
• Snapdragon 865+ 5G
• Snapdragon 870 5G
• SD865 5G

Mid-Range Mobile

• Snapdragon 460
• Snapdragon 662

AR/VR Platforms

• Snapdragon AR1 Gen 1
• Snapdragon XR2 5G
• Snapdragon XR2+ Gen 1

Connectivity

• FastConnect 6700, 6800, 6900, 7800
• QCA6391, QCA6698AU, QCA6797AQ

Modem

• Snapdragon X55 5G Modem RF System

Audio Components

• WCD9370, WCD9375, WCD9380, WCD9385, WCD9390, WCD9395
• WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H

Industrial/IoT

• QCM5430, QCM6490, QCM8838
• QCN9011, QCN9012
• QCS8550, CQ8750M
• G3x Gen 2, Pandeiro

Video Collaboration

• Qualcomm Video Collaboration VC3 Platform

The list spans flagship and mid-range mobile platforms, AR/VR headsets, connectivity modules, audio codecs, and industrial chipsets, which indicates that Qualcomm shares the StrongBox implementation across its product portfolio.

Vendor Security History

Qualcomm's recent security record shows a pattern of critical vulnerabilities in core platform components:

The March 2026 zero day, CVE-2026-21385, affected 234 chipsets. Google's Threat Analysis Group (TAG) discovered it and confirmed it was under "limited, targeted exploitation." Google released patches for 129 Android vulnerabilities, this actively exploited Qualcomm flaw among them. TAG's involvement suggests the exploitation was linked to targeted surveillance operations rather than opportunistic criminal activity.

SecurityWeek reported that an earlier StrongBox vulnerability, CVE-2025-48651, could let attackers extract cryptographic keys from the Qualcomm Secure Execution Environment. That sets a precedent for StrongBox flaws leading to key extraction, which raises the assessed impact of CVE-2026-25276.

Google's 2025 Zero Day Review documents a broader trend of commercial surveillance vendors and nation-state actors stockpiling and deploying zero days against mobile targets, with Android chipsets a frequent target. Zero-day vulnerabilities in mobile platforms, especially in chipsets and firmware, are increasingly valuable to threat actors because they give reliable, persistent access that is hard to detect and mitigate at the OS level.

References

• Qualcomm June 2026 Security Bulletin
• Android Security Bulletin, June 2026
• CVE-2026-25276 NVD Entry
• CWE-129: Improper Validation of Array Index
• Android Hardware Security Best Practices
• Qualcomm: Guard Your Data with the Snapdragon Mobile Platform (PDF)
• Severe StrongBox Vulnerability Patched in Android, SecurityWeek
• CVE-2026-21385: Google Patches Qualcomm Zero Day Exploited, SOC Prime
• Google Addresses Actively Exploited Qualcomm Zero Day, CyberScoop
• Look What You Made Us Patch: 2025 Zero Days in Review, Google Cloud Blog
• MediaTek Estimated To Remain Global Smartphone Chipset Market Leader, WCCFTech
• Google Pixel Binary Drivers