Trust Issues: Exploiting Trust Zone TEEs
Summary: Project Zero's Gal Beniamini analyzed the two major Android TrustZone TEEs, Qualcomm's QSEE and Trustonic's Kinibi, finding that these secure operating systems lag behind modern operating systems in security mitigations and practices. He identified a design issue affecting most devices using both platforms, which he states cannot be fixed on most Qualcomm-based devices or on Kinibi versions prior to 400 without additional dedicated hardware or operations that risk rendering devices unusable.
Why it matters: The TEE is where biometric identifiers, payment data and cryptographic keys are processed, and the flaw is described as difficult or impossible to patch on most Qualcomm devices and on all Samsung Exynos devices other than the Galaxy S8 and S8 Plus.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026