MediaTek Patches Critical Modem Vulnerabilities Affecting Millions of Android Devices

Check your phone's specs or go to Settings → About Phone → Processor. If you see anything starting with "MT" followed by numbers (like MT6877, MT8893), you're probably running MediaTek silicon. Samsung uses mostly Qualcomm and their own Exynos chips, but budget phones and many Chinese manufacturers use MediaTek extensively.

Absolutely, and it's not even that hard anymore. Rogue base stations (IMSI catchers, Stingrays) have been used by law enforcement for years. The difference now is these vulnerabilities let attackers go beyond just intercepting communications

• they can potentially execute code on your device.

That's the million-dollar question. MediaTek says OEMs got patches "at least two months ago," but Android update distribution is a clusterfuck. Major manufacturers might push updates in 2-6 weeks. Budget phone makers? Some never update their devices after release. Check your manufacturer's security update track record.

Not really, which is the scary part.

These are baseband vulnerabilities, so turning off cellular data won't help

• you need cellular connectivity for calls and texts. Your only options are: avoid areas with suspicious cell towers (good luck identifying them), use a phone with Qualcomm or Apple silicon, or wait for your OEM to push the update.

Tons of them. Xiaomi, Oppo, Vivo, Realme, and most budget Android manufacturers use MediaTek extensively. Even some mid-range Samsung phones use MediaTek chips in certain markets. If you paid under $400 for your Android phone, there's a good chance it's running MediaTek.

More realistic than you'd think. Software-defined radio (SDR) equipment to build fake base stations costs a few hundred bucks. Law enforcement agencies already use IMSI catchers routinely. The technical barrier isn't that high anymore, especially with open-source tools available.

Those are less scary because an attacker needs system-level access first. But if they chain these with other vulnerabilities (like a malicious app that gets system permissions), they could escalate to even higher privileges. It's death by a thousand cuts.

Baseband security across the industry is pretty fucked, not just MediaTek. Qualcomm has had similar issues. The problem is these modem components are essentially black boxes running their own operating systems with direct hardware access. When they're compromised, game over.

Android security patch level in Settings → About Phone → Android Security Patch Level should be September 2025 or later if you got the fixes. But this assumes your OEM actually included the MediaTek patches in their security update, which isn't guaranteed.

They're doing the usual corporate security theater

• working with OEMs, coordinating responsible disclosure, etc. But fundamentally, baseband processors will always be high-value targets because they have privileged hardware access and process untrusted network data. This won't be the last time we see vulnerabilities like this.