CVE-2025-21450

A successful man-in-the-middle attack can cause affected devices to consume attacker-modified GNSS assistance data. Potential consequences include location spoofing, incorrect device time or location reporting, and denial of service through corruption of GPS/GNSS-related data structures.

Until updates are deployed, reduce exposure to untrusted or attacker-controlled network paths during GNSS assistance-data retrieval, particularly public wireless networks. Restrict use of unpatched affected devices for workflows that depend on trustworthy location or time data, and validate location/time through independent sources where feasible.

Install the Qualcomm security fix issued in July 2025 through the applicable device manufacturer or carrier update. For Android devices, deploy the relevant Android security update and verify that the device has the vendor security patch level that incorporates the Qualcomm closed-source component fix.