MediaTek Telephony CVE-2026-20483

Exploitation requires that the attacker achieve local code execution on an affected MediaTek-chipset Android device - in practice, this means the target must install an attacker-controlled application, whether through sideloading, a compromised app store listing, or social engineering. The CVSS vector PR:N confirms no Android permissions are required on the malicious app side; the missing permission check is the entire prerequisite on the Telephony service side. Exploitation is limited to: (1) devices using one of the 35 enumerated MediaTek chipsets, (2) running an OEM firmware build that has not yet integrated MediaTek patch ALPS11087526, and (3) where local code execution has been established by the attacker. No network-facing attack path is indicated - AV:L is confirmed by the CVSS vector. There is no required non-default configuration; the Telephony service is present and active by default on all Android devices. UI:N means the exploit executes without further victim interaction after app installation.

Multiple risk signals present a coherent but nuanced picture. CVSS 3.1 rates this 7.7 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting that no Android permissions are required for exploitation and no user interaction is necessary - but the Local attack vector constrains exploitation to scenarios where an attacker already has local code execution (e.g., a sideloaded or trojanized app). EPSS of 0.15% at the 5th percentile signals very low current exploitation probability, consistent with no KEV listing and no identified public exploit code. The combination of PR:N (no calling-app permissions needed) and AV:L (local access prerequisite) means the realistic threat model is a malicious app on the device that silently abuses telephony privilege without requesting dangerous permissions - a meaningful evasion of Android's permission-based defense model. The absence of A (Availability) impact is consistent with the described effect being read/write over telephony state rather than denial of service. For defenders, this is a medium-real-world priority: the broad chipset footprint elevates exposure, but actual exploitation requires the attacker to have already placed code on the target device. OEM patch lag - common in the MediaTek supply chain - may extend the window of exposure significantly beyond MediaTek's own bulletin date.

An attacker distributes a malicious Android application that declares no sensitive telephony permissions in its manifest, bypassing Play Store or enterprise policy reviews that inspect declared permissions. Once installed on a device running an unpatched MediaTek chipset, the app silently calls protected Telephony IPC interfaces - leveraging the missing permission check - to read call history, intercept SMS metadata, or manipulate active calls without any user-visible indication. No public exploit code has been identified at time of analysis, but the straightforward nature of the missing permission check (CWE-862) makes independent exploit development feasible for a motivated actor familiar with Android IPC internals.