Sekoia uncovers chained Chrome-Snapdragon exploit targeting Android
Researchers at Sekoia revealed a campaign exploiting Chrome versions 139-145 and Qualcomm Adreno GPU flaws to infect Android devices. The attack bypassed user interaction, stealing cookies and passwords via AndroSnitch malware. Both vulnerabilities have been patched, rendering updated devices safe from this specific chain.
Key points
- Sekoia researchers identified a mobile hacking campaign targeting Android users through booby-trapped websites without requiring user interaction.
- The attack exploited Chrome vulnerability CVE-2026-3910 to execute code, then leveraged Qualcomm Adreno GPU flaw CVE-2025-27038 to escape the sandbox.
- Vulnerable devices running Chrome versions 139 through 145 were infected with AndroSnitch malware, which stole cookies, logins, and Wi-Fi passwords.
- The campaign specifically affected phones powered by Qualcomm Snapdragon chips containing the Adreno graphics drivers.
- Both security flaws have been patched, meaning devices with up-to-date Chrome and system updates remain protected from this exploit.
Mobile Security Threat Exposed
Security researchers at the French cybersecurity firm Sekoia have unveiled a sophisticated mobile hacking campaign that compromised Android devices by chaining two distinct software vulnerabilities. The attack, which did not require victims to tap links, install applications, or grant permissions, highlights the persistent risks associated with outdated browser and system software on mobile devices. The campaign targeted users who visited hijacked or fake websites while running specific versions of the Google Chrome browser.
The Exploit Chain
The intrusion relied on a two-stage process that leveraged flaws in both the Chrome browser and Qualcomm’s hardware drivers. Initially, the attackers utilized a vulnerability in Chrome, tracked as CVE-2026-3910, to execute malicious code within the browser environment. This initial foothold allowed the malware to interact with the device's graphics processing unit. The second stage exploited CVE-2025-27038, a flaw in the Qualcomm Adreno GPU driver, enabling the code to break out of Chrome’s sandbox. This breakout granted the attackers deeper access to the operating system, bypassing standard security isolations.
Targeted Devices and Versions
The campaign specifically affected Android phones powered by Qualcomm Snapdragon chips, as these devices utilize the Adreno graphics drivers containing the vulnerability. The attack was effective only on devices running Chrome versions 139 through 145. Notably, the researchers observed that version 143 was skipped in the attack chain, a detail Sekoia stated was unclear. Because the vulnerabilities involved both the browser and the underlying hardware driver, the scope of the threat was limited to devices that had not received the latest security patches for either component.
Malware Capabilities
Once the sandbox was breached, the attackers deployed malware identified as AndroSnitch. This malicious software was designed to silently exfiltrate sensitive user data. Specifically, AndroSnitch copied Chrome’s cookies, saved login credentials, and browsing history. In some instances, it also targeted Wi-Fi passwords. The stealthy nature of the infection meant that users were unlikely to notice the compromise immediately, allowing the attackers to gather extensive personal information over time.
Patch Status and Mitigation
Sekoia emphasized that both the Chrome flaw and the Qualcomm Adreno GPU driver bug have already been patched. Consequently, Android phones running up-to-date versions of Chrome and the latest security updates are safe from this specific attack vector. The revelation serves as a critical reminder for users to maintain their software in a current state. Devices that have not applied recent updates remain vulnerable to similar exploits that may target unpatched software components.
Global Implications
This incident underscores the interconnected nature of modern mobile security. The combination of a browser vulnerability with a hardware driver flaw demonstrates how attackers can chain weaknesses to achieve significant system access. For the global technology sector, it highlights the importance of coordinated patching across software and hardware providers. Users are advised to verify their browser versions and system update status to ensure protection against such chained exploits.
Key takeaways
Sekoia researchers discovered a campaign exploiting Chrome and Qualcomm Adreno GPU flaws to infect Android devices.
The attack required no user interaction and targeted Chrome versions 139 through 145 on Snapdragon-powered phones.
Malware named AndroSnitch was deployed to steal cookies, logins, browsing history, and Wi-Fi passwords.
Both vulnerabilities have been patched, rendering updated devices immune to this specific chain.
The incident highlights the risk of chaining browser and hardware driver vulnerabilities for deeper system access.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
