Phone chipmaker Qualcomm fixes three zero-days exploited by hackers

Qualcomm has released patches for multiple vulnerabilities in its chips, including three zero-day exploits potentially used in targeted hacking campaigns, according to the company's bulletin citing Google's Threat Analysis Group. The zero-days, reported by Google in February, impact numerous Qualcomm chipsets, and while patches are available to device manufacturers since May, deployment to end-user devices may take several weeks; Google Pixel devices are reportedly not affected. Given the broad access that chipsets have within operating systems, these vulnerabilities represent a significant security risk, particularly for devices holding sensitive data, as demonstrated by past instances of Qualcomm chip exploitation.

Analysis

Qualcomm (QCOM) has disclosed and released patches for multiple security vulnerabilities affecting dozens of its chipsets, a development with a moderately negative sentiment (-0.5 for general sentiment, -0.7 specifically for QCOM). Notably, this includes three zero-day vulnerabilities (CVE-2025-21479, CVE-2025-21480, CVE-2025-27038) which, according to Google's Threat Analysis Group (TAG) cited by Qualcomm, may already be under "limited, targeted exploitation." These flaws were initially reported to Qualcomm by Google's Android security team in February, with patches made available to device manufacturers (OEMs) in May. The critical nature of zero-days, which are unknown to vendors at discovery, makes them potent tools for cyber attackers. A key concern arises from the fragmented Android ecosystem; while Qualcomm has provided fixes, the timeline for these patches to reach end-user devices depends on individual OEMs, potentially leaving many devices vulnerable for weeks. Google (GOOGL, GOOG) has stated its Pixel devices are not affected, highlighting a divergence in security posture within the Android space. This incident underscores the persistent targeting of chipsets by malicious actors due to their privileged access within operating systems, as evidenced by past exploitation of Qualcomm chips, such as the zero-day identified by Amnesty International last year. The market impact score of 0.4 suggests a contained but notable event primarily affecting Qualcomm's perceived security standing.

Key Decisions for Investors

• Investors in Qualcomm (QCOM) should closely monitor the speed and breadth of OEM patch deployment for these vulnerabilities, as prolonged exposure or confirmed widespread exploitation could negatively impact sentiment and potentially lead to increased remediation costs or reputational damage.
• Consider the recurring nature of chipset vulnerabilities as an inherent risk factor for Qualcomm; the current admission of 'limited, targeted exploitation' elevates this concern, warranting vigilance for any escalation or broader impact on device security.
• Evaluate the potential downstream implications for device manufacturers heavily reliant on Qualcomm chips, as delays in their patching cycles could expose end-users and reflect poorly on the security of the broader Android ecosystem powered by Qualcomm.