Kaspersky Unveils Critical Qualcomm Hardware Vulnerability (CVE-2026-25262) at Black Hat Asia 2026
Researchers from Kaspersky ICS CERT have exposed a high-stakes hardware vulnerability in widely used Qualcomm chipsets, affecting millions of smartphones, IoT devices, and automotive components. Identified as CVE-2026-25262, the flaw resides within the BootROM, the immutable initial code executed during a device's boot process. By exploiting the low-level Sahara protocol in Emergency Download Mode (EDL), physical attackers can bypass Secure Boot mechanisms to gain persistent, undetectable control over the target hardware.
The vulnerability impacts several chipset series, including MDM9x07, MDM9x45, MSM8909, and SDX50, among others. Security expert Sergey Anofrienko warned that this exploit allows for the planting of "near-invisible" malware that survives standard reboots and can intercept sensitive data, including passwords, location history, and live camera/microphone feeds. Because the flaw is hardwired into the silicon, traditional software patches cannot fix the underlying BootROM code, making physical device security and supply chain integrity the primary lines of defense for affected organizations.