This Android Bug Can Crack Your Lock Screen in 60 Seconds

A newly disclosed Android vulnerability is making noise for a good reason. Researchers showed that some phones powered by certain MediaTek chipsets can be cracked in under 60 seconds, letting an attacker recover the lock screen PIN, decrypt storage, and even pull sensitive wallet seed phrases from the device.

The issue is tracked as CVE-2026-20435 and affects specific MediaTek SoCs that use Trustonic’s Trusted Execution Environment. Malwarebytes says the exposure could stretch across a big slice of the Android market, especially lower cost phones that rely on these chipsets.

This is the kind of bug that cuts through the usual comfort people get from a lock screen. Users often assume a PIN plus encryption is enough to protect data on a lost phone, but this case shows those protections can fall apart before Android even fully boots. That makes it a serious theft and privacy issue, not just another technical security story.

How this Android flaw works

According to Malwarebytes, researchers demonstrated the attack by connecting a vulnerable phone to a laptop over USB. From there, they were able to recover the handset PIN, decrypt storage, and extract seed phrases from software wallets. The attack targets the boot process, which happens before Android has a chance to fully load its normal defenses.

MediaTek’s March 2026 Product Security Bulletin lists CVE-2026-20435 under the preloader component and says the flaw can allow a read of device unique identifiers because of a logic error. The bulletin also names a long list of affected chipsets, showing this is not limited to just one or two phone models.

That is why this bug stands out. It is not about tricking a user into tapping a bad link or installing a fake app. It is about someone with physical access to the device using low level weakness in the startup chain to get around protections that most users trust every day.

Why it matters more than a normal phone bug

The biggest concern is what comes after the unlock bypass. Once an attacker can access encrypted storage, the damage goes far beyond photos or messages. Malwarebytes reports that seed phrases from software wallets were among the items researchers could extract, which turns a stolen phone into a direct path to financial loss.

The timing also matters. MediaTek says phone makers were notified and given the relevant security patches at least two months before the bulletin was published on March 2, 2026. That means fixes may already exist at the chipset level, but users still have to wait for their phone brand to package and ship the update.

That vendor delay is often where Android security gets messy. Google’s March 2026 Android Security Bulletin says devices on security patch level 2026-03-05 or later address all issues covered in that bulletin, but chipset specific fixes still depend on how quickly manufacturers update their own devices.

What Android users should do now