Android Phone Lock Bypass Threatens 1 in 4 Devices — Full Disk Keys Extracted in Under 60 Seconds
An exploit demonstrated against an android phone can recover a handset PIN, extract root cryptographic keys and decrypt storage in less than a minute, undermining the protection that full‑disk encryption and the lock screen are supposed to provide. The vulnerability, tracked as CVE-2026-20435, affects certain MediaTek system‑on‑chips that use Trustonic’s Trusted Execution Environment and is estimated to be present in roughly one in four Android devices, primarily lower‑cost models.
How the Android Phone lock bypass works
Researchers from Donjon, the research division of Ledger, showed the technique by connecting a vulnerable handset to a laptop over a USB cable. The exploit targets the SoC boot chain and the device’s Trusted Execution Environment, extracting the root keys that protect Android’s full‑disk encryption before the operating system has fully booted. In demonstrations the team recovered the phone’s lock PIN, decrypted on‑device storage and pulled seed phrases from software wallets, including examples cited by the researchers.
The attack succeeds because the cryptographic protections that are meant to remain sealed until after a secure boot sequence are exposed during an early stage of the boot process on affected hardware. That exposure allows an external host to brute‑force or otherwise extract the secrets that guard encrypted data, enabling decryption in under 60 seconds in some tests and in about 45 seconds in demonstrations.
Background, scale and patch status
Both the technical root cause and the scale of exposure are tied to specific MediaTek chipsets using Trustonic’s TEE. Public assessments in the research materials estimate the vulnerability touches roughly one-quarter of Android handsets, concentrated among less expensive models that use the affected chips. MediaTek has published a security bulletin addressing CVE-2026-20435 and released a firmware patch; device manufacturers must integrate that firmware into their own update flows for end users to receive fixes.
That dependency creates a patching gap: while a vendor‑level firmware fix exists, the timeline for distribution varies by manufacturer and by where a model sits in its support lifecycle. Devices that are nearing end‑of‑life may never receive the necessary update, leaving owners exposed unless they replace hardware. The practical mitigation at the user level therefore starts with ensuring any available security update from the device maker is installed, and with limiting physical access to the handset.
Expert perspectives and wider implications
Charles Guillemet, Chief Technology Officer at Ledger, described the finding and its history: “As far as we could tell, this vulnerability has been present for a very long time — probably a decade — and yet had not so far been discovered publicly. ” He added a cautionary note about exploitation history: “We don’t know if the particular vulnerability we discovered has been used by attackers in the past — there’s no evidence of this, ” and warned that similar high‑impact flaws may still exist.
The immediate security implications are clear: where hardware roots of trust are compromised, software‑level defenses such as lock screens and full‑disk encryption no longer guarantee confidentiality. The demonstration also shows an attack vector that privileges an attacker who has brief physical access to a device and a USB connection, expanding the threat model beyond remote network exploitation to include in‑person data extraction.
The broader fallout extends to users who store sensitive credentials and cryptocurrency seed phrases on their phones; the demonstrations specifically included extraction of seeds from popular software wallets. For organisations managing device fleets, the discovery underscores the importance of inventorying device hardware and prioritising updates for models built on the affected chipsets. MediaTek’s security bulletin is the technical corrective step; the real test will be how quickly manufacturers push the firmware into public security updates.
For individual owners of an android phone that might be affected, vigilance matters: apply any pending security update, keep devices physically secure and question continuing use of a model that no longer receives firmware patches. As device makers roll out fixes, the community will be watching how rapidly manufacturers close this gap and what proportion of devices remain unpatched — and whether other TEEs or chip families show related weaknesses. Will manufacturers accelerate firmware rollouts for older, lower‑cost models, or will a substantial portion of devices remain vulnerable in the wild?
