This vulnerability, CVE-2026-25262, involves a write-what-where condition in the Qualcomm Sahara protocol used during device boot and programming. Experimental research confirmed that on the Snapdragon 8 Gen 1 (SM8450) platform, an attacker can inject a value into the Firehose loader's authorization state structure in SRAM, bypassing signature verification and partially bypassing authentication. The Firehose loader executes and responds to basic commands without authorization errors, but full access to UFS storage is not yet achieved, likely due to incomplete loader initialization or TrustZone/SMC call dependencies. This expands the known affected platforms beyond the official list limited to 32-bit legacy chipsets. The research is documented with static analysis, logs, and experimental tools but does not include full exploit code. The vulnerability remains under active investigation with no confirmed patch or fix.

The vulnerability enables an attacker with access to the Sahara protocol interface to perform arbitrary writes to SRAM, bypassing signature verification and partially bypassing Firehose loader authorization on Snapdragon 8 Gen 1 devices. This could allow unauthorized code execution in the loader context. However, full access to the device's UFS storage has not been demonstrated, indicating incomplete exploitation. The expanded affected platform scope increases the potential attack surface to modern Qualcomm flagship SoCs. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published for this vulnerability on Snapdragon 8 Gen 1 platforms. Until a vendor fix is available, mitigation options are limited. Monitor official Qualcomm security advisories for updates. The research is ongoing, and further analysis may clarify additional mitigation steps.