Affiliate links on Android Authority may earn us a commission. Learn more.

Hackers used Chrome and Snapdragon GPU flaws to hack Android phones

Nov 5, 2026 — 12:36 AM ET

Preferred Source

Google Discover

• A security firm has found that hackers exploited a Chrome bug and a Qualcomm Adreno GPU driver flaw to infect Android phones that visited a booby-trapped website.
• The attack targeted Chrome versions 139 to 145 on Android and stole browser cookies, saved logins, browsing history, and Wi-Fi passwords.
• Both flaws had already been patched, so phones running up-to-date Chrome and security updates remained safe.

Security researchers at Sekoia have detailed a mobile hacking campaign that went after Android and iPhone users through hijacked and fake websites. On Android, the attackers didn’t need victims to tap a link, install an app, or grant a permission. Opening an infected page in an outdated version of Chrome was enough.

According to Sekoia’s report, the attack on Android worked in stages. First, it used a Chrome flaw tracked as CVE-2026-3910 to run code inside the browser. It then exploited CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, to break out of Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics are found in Snapdragon chips, phones powered by Qualcomm’s silicon were the ones affected.

The attack only targeted Chrome versions 139 through 145, though it skipped version 143 for reasons Sekoia says are unclear. Once a phone was compromised, the attackers dropped malware that Sekoia calls AndroSnitch. It copied Chrome’s cookies, saved login data, and browsing history, along with the phone’s saved Wi-Fi configuration file, which contains the passwords for networks you’ve connected to. Stolen cookies are especially valuable since they can let attackers slip into accounts that are already signed in.

Interestingly, the Android exploit was coded to stop if it detected a Samsung Galaxy S25 Ultra. Sekoia didn’t name any other phone models or Android versions that were specifically targeted.

The hack reportedly reached victims in several ways. The attackers injected malicious code into legitimate websites, set up lookalike copies of real sites, and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. The fake sites included a copy of the America250 website and one mimicking a luxury London hotel close to UK government offices. A script on these pages profiled each visitor’s device and then served the matching exploit.

Sekoia says the hacking campaign is linked to APT29, a hacking group tied to Russia’s foreign intelligence service. The targets suggest the group was mostly after diplomats and people connected to the war in Ukraine rather than ordinary Android and iOS users. Yes, iPhones were targeted too, with one exploit chain stealing cookies on iOS 16 through 17.4 and the DarkSword exploit grabbing messages, photos, and passwords from devices on iOS 18.5.

The good news is that every flaw used in this hacking campaign had already been patched before the attacks began.

To make sure you remain protected, update Chrome from the Play Store and check that you’re on a newer version than 145 by opening Chrome’s menu and going to Settings > About Chrome. It’s also worth installing the latest security update for your phone, since fixes for Qualcomm’s GPU drivers are delivered through those monthly patches.

Source: Read original article