Chrome and Adreno GPU Flaws Used to Hack Android Phones via Websites

Researchers at security firm Sekoia have detailed a mobile attack campaign that used compromised and fake websites to target both Android and iPhone users. On Android, the notable detail is that the attackers needed no tap on a link, no app installation and no permission from the victim. Opening an infected page in an outdated version of Chrome was enough.

According to the report, the attack targeted Android devices running Chrome versions 139 through 145. Both vulnerabilities had already been patched, so phones running an up-to-date Chrome and current security updates were safe. The danger was limited to users who had not updated their browser or system.

A two-stage attack chain

Sekoia's report describes the Android attack as unfolding in stages. In the first, a Chrome vulnerability tracked as CVE-2026-3910 was exploited to run code inside the browser. The user did not have to do anything at this point; visiting the malicious page was sufficient.

The second stage relied on CVE-2025-27038, a flaw in Qualcomm's Adreno GPU driver. It allowed the attackers to break out of Chrome's sandbox and gain deeper access to the phone. Code execution inside the browser on its own yields only limited access, whereas a sandbox escape opens the way to a much larger part of the device.

Because Adreno graphics units are part of Snapdragon chips, the affected devices were phones with Qualcomm processors. In other words, the second link in the chain only worked on Android devices using that chip family.

What data was stolen

According to the report, on Android the attack stole browser cookies, saved session data, browsing history and Wi-Fi passwords. Cookies and stored login details are among the most valuable data when it comes to unauthorized account access. The inclusion of Wi-Fi passwords suggests the attack reached beyond the browser to the device's saved network information.

The campaign was not limited to Android. The researchers say iPhone users were also targeted through compromised and fake sites, though the attack chain detailed here belongs to the Android side.

What users should do

Since both flaws have been patched, updating remains the main defense. Running the current version of Chrome and installing the device maker's security patches on time was enough to stop this chain; phones with up-to-date Chrome and security updates were not at risk.

The episode also shows that a browser's sandbox is not sufficient on its own, as a driver-level flaw can be used to get past that barrier. That makes regular system and driver patches just as important as browser updates. Checking which version of Chrome your phone is running, and whether the latest security update is installed, is the simplest step against attacks of this kind.