Researchers disclose four Qualcomm chipset driver flaws dubbed “Quadrooter” allowing malicious apps to gain root access on Android phones with Qualcomm chipsets
All versions of Android are vulnerable to these flaws, which won't be fully patched until the September security release next month.
Context & Ripple Effects
Quadrooter lands just three months after Qualcomm patched a five-year-old flaw exposing SMS and call history on older Android builds — together they mark 2016 as the year chipset-level code, not just the OS, became a headline attack surface for Android.
The disclosure also sets a template the corpus keeps repeating: Qualcomm driver bugs disclosed by researchers, fixed through Google's monthly Android Security Bulletin, then echoed years later in the August 2019 QualPwn Wi-Fi bugs, the 2020 Snapdragon DSP takeover flaws, and zero-days Google reported as under exploitation in 2025.
First-order effects
- Owners of any Android phone with a Qualcomm chipset are exposed to malicious apps gaining root access now, with no complete fix available until the September security release — a month-long window where no app-store screening fully protects them.
- Qualcomm and device makers must route fixes through Google's monthly bulletin rather than shipping directly, leaving carrier update pipelines as the bottleneck for actually reaching handsets.
Second-order effects
- Google's monthly security program becomes the de facto patch channel for silicon-level flaws, raising pressure on OEMs to ship bulletins promptly or wear the reputational cost of vulnerable devices.
- Rival chipset vendors get pulled into the same scrutiny — the pattern recurs with a MediaTek rootkit exploit patched by Google nearly a year after it surfaced publicly, showing slow disclosure-to-patch cycles are an industry-wide liability, not a Qualcomm-only one.
Third-order effects
- If the pattern holds, security research permanently shifts up the stack from Android itself to chipset drivers and DSP firmware, making chip vendors' patch discipline a standing procurement criterion for phone makers.
- The recurring cycle — researcher disclosure, monthly-bulletin fix, long tail of unpatched devices — points toward regulatory scrutiny of how quickly silicon vendors deliver fixes to end-user hardware.
The trend: Mobile security is migrating from the operating system to chipset firmware and drivers, with Qualcomm's recurring disclosures and Google's monthly bulletin acting as the industry's patch clock.