MediaTek Telephony Permission Bypass Vulnerabilities

Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.

Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.