When it comes to malware, users are conditioned to look outside their device. Don’t open malicious attachments, follow suspicious links or fall victim to supposedly official emails from banks or credit agencies.

But what happens when pre-existing flaws make it possible for attackers to fully control a mobile phone or tablet? That’s the case with Quadrooter, a set of four privilege escalation vulnerabilities that may affect up to 900 million devices running Qualcomm chips, according to ZDNet. Here’s the scoop on this ramped up rooting risk.

Android Attacks on the Rise

There’s been a significant uptick in Android malware over the last few years as cybercriminals find ways to exploit mobile apps and recognize the huge potential this billion-user market represents.

As noted by Ars Technica, for example, a malware family called HummingBad — which may actually be part of Shedun — managed to infect more than 10 million handsets worldwide. Using unfixed vulnerabilities from older Android versions, the malware is able to root Android phones, install malicious apps and generate fraudulent advertisements. So far, attackers have enjoyed a significant payday with the malware producing more than $300,000 in revenue per month.

Then there are banking attacks like Android.Fakebank. According to BGR, not only does this do the old “steal account details and transfer money” shtick, but also prevents users from directly calling their bank to address the problem of fraudulent logins.

Put simply, cybercriminals have a vested interest in finding and exploiting new Android issues to grab valuable user data.

Fearsome Foursome

The so-called Quadrooter problem, meanwhile, takes a different track by targeting vulnerabilities on factory-installed Qualcomm chips.

As noted by PC Mag, the flaws were found by security firm Check Point and detailed at the recent DEF CON conference; the four new privilege exploits let attackers access saved data, change or remove system files, delete or add apps, and access virtually all phone services.

Since the Qualcomm chip drivers come pre-installed, there’s no way for users to prevent the potential of infection. If attackers can convince users to install a single malicious app, the bad guys gain total device control.

Qualcomm Chips In

Qualcomm and Google have been working to remedy the flaws, which affect everything from the Nexus 5X to Galaxy S7 Edge and even Blackberry’s DTEK50. While three vulnerabilities were addressed in the most recent security update, one is still outstanding because the patch wasn’t ready in time.

Qualcomm did release the affected code to partners, meaning it’s possible for device manufacturers to design their own in-house solution. Check Point now offers a Quadrooter checking tool that scans devices to determine if they’re fully protected as well.

While the Quadrooter issues were quickly identified and addressed by both the manufacturer and Google, the proof of concept here is worrisome. Almost 1 billion Android phones were put at risk of complete root access not because of phishing emails or malvertising, but due to inherent flaws on original device chipsets.

It’s a warning to developers and manufacturers alike: No segment of the mobile ecosystem is beyond the reach of motivated malware-makers.