Qualcomm patches 11 Snapdragon flaws: CVE-2026-25289 needs no login and no tap

Qualcomm, which makes the core components inside most Android phones, published 11 vulnerabilities in its chips on August 4, 2026. Its Snapdragon line sits inside a large share of the handsets sold in Japan — Xperia, AQUOS and parts of the Galaxy range among them.

The heaviest of the 11 is CVE-2026-25289, rated 9.6 out of 10. It sits in the Wi-Fi mechanism that lets nearby devices find each other directly, and anyone within radio range needs neither a login nor any action from the person holding the phone.

The conclusion first. There are no reports of exploitation. The announcements field of Qualcomm's bulletin reads "None," and none of the 11 appears in the US government's catalogue of vulnerabilities known to be under attack. Nothing needs to be switched off today. Apply the update when your handset maker ships it, and that is enough.

Who goes after this, and what for

The only people who can use this are those able to put themselves in the same place as their target. Radio range means the same café, the same train carriage, the same meeting room. This is not something that arrives from anywhere on the planet.

From that position, what they can do is send crafted radio frames that break the behaviour of the target's wireless component. Depending on how it breaks, operations that should never be permitted can run inside the radio chip. Qualcomm's own rating holds that the damage need not stay inside that chip — it can reach other parts of the device.

For the person carrying the phone, the awkward part is that simply having it switched on puts them in scope. No screen to unlock, no dubious link to tap. That said, anyone willing to physically get that close is usually targeting a specific individual or organisation. This does not have the character of a virus that spreads indiscriminately; it weighs most on people who have a reason to be targeted. If you manage corporate handsets, it belongs on the list of updates you track.

The heaviest one sits in Wi-Fi's "find what is nearby" feature

CVE-2026-25289: a declared length is taken at face value

Qualcomm's description is one sentence: "Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values."

Translated: NAN is the mechanism that lets nearby devices discover one another directly, without going through a Wi-Fi access point. Android exposes it as "Wi-Fi Aware," and apps that look for surrounding equipment build on it. Within that discovery exchange, one of the fields declares how many bytes of data follow.

The flaw is that the declaration is trusted even when it does not match reality. Push in more data than the prepared space holds, and neighbouring memory is overwritten. That is the "memory corruption" Qualcomm refers to, filed under a classic category (CWE-121).

The severity notation is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. PR:N means no login required, UI:N no user action, and AV:A that being inside radio range is the condition. Then S:C — the piece pushing the figure up to 9.6, indicating that the damage can spread beyond the radio chip itself.

Whether this works on a handset with no Wi-Fi Aware apps installed, or whether turning the feature off avoids it, is not stated anywhere in Qualcomm's bulletin. No proof-of-concept code has been published either. What we could confirm ends at "there is a flaw in that processing," and we will not write past that.

Is your phone affected

Qualcomm lists affected chips by part number — 201 of them for the 9.6 issue. Most are automotive or networking parts; only 17 carry a Snapdragon name a general reader would recognise.

Here is the catch. Which list a chip appears on differs by generation. The 9.6 issue skews towards newer silicon, and Snapdragon 865, 870, 888 and 8 Gen 1 are not on it.

There is one way to read that table. Being off the list for the heaviest issue is not reassurance. The older generations missing from the 9.6 entry are firmly present on the 8.1 and 7.5 ones. Whichever generation you carry, you land on at least one of the 11.

Qualcomm also notes under each list that "the list of affected chipsets may not be complete." Absence from the list is not proof of safety.

Your handset's chip part number is not shown in the settings screen; looking it up by model name is faster. Among devices sold in Japan, Snapdragon appears in the Xperia range, the AQUOS range and parts of the Galaxy range. Google's Pixel uses Google's own Tensor silicon rather than Snapdragon, so these 11 do not apply to it. Pixel does have a separate issue of its own, covered below.

Two issues that bite older handsets

CVE-2026-24079: requests missing their credentials get through

Rated 8.1. It lives in the cellular modem, and the description reads "cryptographic issue while processing registration requests with malformed or missing authentication parameters" — requests that ought to be rejected are accepted. It lists 143 chipsets, spanning the 865 era through to 8 Elite. Reported on July 18, 2025; device makers were notified on February 2, 2026.

CVE-2026-24084: reported almost four years ago

Rated 7.5. The handset does not verify the consistency of its own security capability information. Mobile networks need defences against an old exchange being captured and replayed later; that check was missing.

What stands out here is the date. The bulletin records the report as arriving on August 25, 2022 — close to four years before publication. Fixes touching radio standards need agreement across the standards body and every vendor, which takes time. It was still out in the world the whole while.

The rest

The remainder covers fingerprint authentication processing (CVE-2026-24080, 7.8), Bluetooth handling (CVE-2026-24076, 6.7), a temporary loss of connectivity (CVE-2026-25288, 7.4) and personal information becoming visible to an unauthorised party (CVE-2026-24078, 6.5). Two entries are automotive-only (CVE-2026-24083 and CVE-2026-25292) and do not touch ordinary phones.

CVE-2026-25288 at 7.4 has an unusual shape: its list holds only Snapdragon 8 Elite Gen 5 and 7 Gen 4. The affected part exists only in the newest silicon.

No exploitation has been observed

Stated plainly: none of the 11 has been reported as used in an attack.

Three grounds. First, the announcements field of Qualcomm's bulletin holds the single word "None" — where confirmed exploitation would be recorded. Second, we checked the US government's catalogue of vulnerabilities known to be under attack: none of the 11 appears among the 1,660 entries in the August 4 version, which we compared in full. You can follow the catalogue on our CISA KEV dashboard. Third, no proof-of-concept code has been published.

Qualcomm silicon has certainly been attacked before. Twelve Qualcomm-related entries sit in that catalogue, the most recent being CVE-2026-21385, added on March 3, 2026 — also a memory corruption issue, like this month's 9.6. Which is precisely why the absence of such a note on these 11 carries weight.

The Pixel issue is a different story entirely

On the same August 4, Google published its Pixel update bulletin. It contains exactly one entry: CVE-2026-0163.

The numbers around it are being read two ways, so here they are side by side.

The 9.8 figure did not come from Google. It is a secondary assessment added afterwards by a US government body. The substance is a use-after-free in a video processing component that can lead to privilege escalation.

Scope is the part that matters. This one is Pixel-only, originating in a component tied to Google's own silicon. Snapdragon handsets — Xperia, AQUOS, Galaxy — are not affected. It is sometimes presented as "a critical 9.8 Android flaw," but the reality is a single Pixel-specific issue that the vendor itself rates one tier lower. The fix lands in security patch level 2026-08-05 and onwards, and no exploitation has been reported here either.

The main Android bulletin for August, meanwhile, still carried no vulnerability table at all as of midday on August 5. The July edition stated outright that it contained no vulnerabilities, making this two months running. The page carries standard wording about publishing patches and revising the bulletin within 48 hours, so entries may yet be added.

When does it get fixed, and what can you do

Qualcomm says patches are being shared with device makers. Across these 11, the notification dates fall on February 2, 2026 and May 4, 2026 — three to six months before publication, meaning vendors have had them in hand for a while.

What has not been published is when any of it reaches a consumer handset. That is set by each manufacturer and carrier, and Qualcomm's own guidance is to contact the device maker. Historically these ship bundled into Android's monthly updates, in which case the security patch level date is the marker to watch.

Three things are within your control. First, check for a pending security update and apply it — on most Android devices, Settings → System → Software update shows the level currently installed. Second, if you are on a handset that no longer receives updates, note that issues like these will simply never be fixed on it, and weigh replacement accordingly. Third, avoid leaving wireless features on when they are not needed. The third is not a confirmed mitigation for this specific flaw, but given that radio range is the precondition, it is not irrelevant either.

On related component-level issues, we have also covered flaws in the UNISOC chips used by some Rakuten Mobile and Y!mobile handsets and Galaxy vulnerabilities exploitable without any user action.

Summary

Qualcomm published 11 vulnerabilities across Snapdragon and related chips on August 4, 2026. The heaviest, CVE-2026-25289 at 9.6, sits in the Wi-Fi mechanism for direct device-to-device discovery and needs neither authentication nor user action from anyone within radio range.

Even so, there is no cause for alarm today. No exploitation has been reported and no proof-of-concept code exists. The action available to readers is to apply the update when it arrives. That is all.

What is worth retaining is that the affected lists split by generation. The older silicon missing from the heaviest entry appears on two others. Neither "mine is new" nor "mine is old" is a position of safety here.

And it is worth recording that one of the 11 took close to four years from report to publication. Your handset is fixed when your manufacturer ships the update. The day a flaw is disclosed and the day your phone is fixed are two different days.

Frequently asked questions

Is there anything I should do right now?

Check the settings screen for a pending security update and apply it if one is waiting. Nothing beyond that is called for, because no exploitation has been reported and no proof-of-concept code has been published.

Does this affect iPhones?

These 11 are flaws in Qualcomm chips. Some iPhone generations do use Qualcomm cellular components, but the affected lists are given in Qualcomm's own brand names such as Snapdragon and contain no iPhone models. Apple has issued no notice.

Does turning Wi-Fi off protect me?

Unconfirmed. Qualcomm's bulletin does not state which features must be active for this to work, and no primary source says disabling the radio avoids it. The accurate answer is that it cannot be asserted.

Where do I find my phone's chip part number?

It is not normally shown in the settings screen; the manufacturer's specification page for your model is the reliable route. Note also that the affected lists contain many part numbers outside the Snapdragon branding, which only the device maker can match.

My older handset no longer gets updates.

Then this fix will not reach it. The affected lists include generations from several years ago such as the 865 and 870, so on a device past its update window these 11 stay open.

Sources

• ・Qualcomm Security Bulletin - August 2026 (primary source for the chipset lists and announcements field)
• ・NVD CVE-2026-25289
• ・NVD CVE-2026-24079
• ・NVD CVE-2026-24084
• ・NVD CVE-2026-25288
• ・MITRE CVE Record CVE-2026-25289 (publication timestamp)
• ・Pixel Update Bulletin - August 2026
• ・Android Security Bulletin - August 2026
• ・CISA Known Exploited Vulnerabilities Catalog (August 4, 2026 version, all 1,660 entries compared)
• ・Qualcomm support (the channel for chipset enquiries)