Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
Summary: Project Zero's Gal Beniamini found vulnerabilities in Broadcom's FullMAC Wi-Fi SoC firmware that allow remote code execution on the chip, demonstrated on a fully updated Nexus 6P running Android 7.1.1 NUF26K. The affected chips appear in the Nexus 5, 6 and 6P, most Samsung flagship devices, and all iPhones since the iPhone 4, and two of the bugs are triggered when connecting to networks supporting 802.11r Fast BSS Transition or Cisco's CCKM roaming.
Key Takeaway: The attack surface sits in a proprietary firmware blob that platform hardening on the application processor never touched, and the bugs fire during ordinary roaming connections, so a device can be compromised by Wi-Fi proximity alone with no user interaction.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026