A security bug has been uncovered in dozens of Qualcomm chipsets that could pave way for Android malware capable of stealing access to your online accounts.

The problem deals with a Qualcomm technology that was designed to securely store private cryptographic keys on board the device. The Qualcomm Secure Execution Environment or QSEE can do this by placing the keys in an isolated area of the chip, which remains separate from the main processor.

The QSEE should be impenetrable, even when the Android operating system has been compromised. But apparently Qualcomm's implementation isn't perfect. You can actually manipulate the system to leak the private keys stored inside the QSEE, according to Keegan Ryan, a researcher with cybersecurity firm NCC Group.

On Tuesday, he published a paper documenting the vulnerability. To pull off the hack, Ryan found he could analyze a Qualcomm chip's memory cache for clues on how to piece together the private keys held inside the QSEE. He demonstrated this by extracting a 256-bit ECDSA key from a Nexus 5X phone after collecting memory cache samples over a 14-hour period.

According to Ryan, a hacker could use the security bug to exploit how mobile apps let us sign in over a smartphone. After we enter the password, the mobile app will typically generate a cryptographic key pair, which can be used to prove that all future login attempts come from the same device.

"However, if an attacker uses this vulnerability to steal the key pair, the attacker can impersonate the user's device from anywhere in the world, and the user cannot stop it by powering down or destroying their device," Ryan told PCMag.

The attacker also doesn't need physical access to the Qualcomm-powered device to extract the keys. What's necessary is root access to the phone, which could be achieved by getting malware on to the device.

Of course, any successful malware infection can cause all kinds of mayhem. But Ryan said the Qualcomm vulnerability is still dangerous because it can make an already serious attack worse. "The attacker can run the malware one time, and extract the key. They now have permanent and unrestricted ability to create (authentication) signatures," he added.

The good news is that Qualcomm has patched the security bug, (CVE-2018-11976), which affects Snapdragon chipsets including the 820, 835, 845 and 855, among many others. Ryan's company, NCC Group, notified Qualcomm about the vulnerability back in March 2018.

"We commend the NCC Group for using responsible disclosure practices surrounding their security research," the chipmaker said. "Qualcomm Technologies issued fixes to OEMs (original equipment manufacturers) late last year, and we encourage end users to update their devices as patches become available from OEMs."

The fix is also rolling out through Android's April security update.