Archive — US — techcrunch
Phone chipmaker Qualcomm fixes three zero-days exploited by hackers
Qualcomm has released patches for three zero-day vulnerabilities in its chips, following reports from Google's Threat Analysis Group. These flaws have been linked to targeted hacking campaigns, emphasizing the risks associated with mobile device chipsets. Device manufacturers must apply the patches, delaying their deployment and leaving some devices vulnerable.
Key points
- Qualcomm identified three zero-day vulnerabilities (CVE-2025-21479, CVE-2025-21480, CVE-2025-27038) that are being exploited in hacking.
- Google's Threat Analysis Group informed Qualcomm about the vulnerabilities in February.
- Zero-days are unknown to manufacturers and valuable to cybercriminals due to their stealth.
- Qualcomm delivered patches in May but device manufacturers are responsible for applying them, risking exploitation during delays.
- Historically, chipsets like those made by Qualcomm are frequent targets for hackers due to their access to sensitive data.
Why it matters
- The rise of zero-day vulnerabilities highlights the ongoing cyber security threats facing IT infrastructure, especially regarding mobile devices.
- Historically, incidents like the Qualcomm zero-day exploited by authorities demonstrate the potential misuse of technology.
- In 2025, the evolution of Internet of Things (IoT) devices may lead to increased vulnerability; ensuring security in chipsets will be crucial.
Qualcomm's patch release for critical vulnerabilities signals the ongoing need for robust cybersecurity in mobile technology, with implications for device manufacturers and users in managing risks associated with zero-day exploits.