Sekoia says Chrome bug and Qualcomm Adreno GPU flaw let attackers steal cookies and Wi-Fi passwords
Opening the wrong web page was enough. In a campaign detailed by security firm Sekoia, attackers infected Android phones with AndroSnitch malware when people visited hijacked or fake websites in an outdated version of Chrome.
There was no link to tap, no app to install and no permission to grant.
How did the Android Chrome exploit work?
The attacks took place in phases. First, a vulnerability found in Google’s Chrome browser named CVE-2026-3910 allowed the attackers to execute arbitrary code. Next, a security issue in the Adreno GPU driver made by Qualcomm known as CVE-2025-27038 allowed attackers to bypass Chrome’s sandboxing mechanism for Chrome’s code and give the code increased privileges on the phone.
Since Adreno GPUs are found in Snapdragon processors, it was Qualcomm chip-powered phones that were vulnerable to the attacks.
AndroSnitch, once installed, would steal Chrome’s cookies and save login credentials and browsing history. Moreover, the app would also copy the configuration file for Wi-Fi networks stored on your phone, allowing the attacker access to all the Wi-Fi passwords you may have used before.
Cookies are extremely valuable since they will allow attackers to access your account if it is currently logged in.
The exploit only went after Chrome versions 139 through 145, skipping 143 for reasons Sekoia calls unclear. It was also coded to stop if it detected a Samsung Galaxy S25 Ultra. Sekoia didn’t name any other targeted phone models or Android versions.
iPhone users were in the crosshairs too, through separate exploit chains. Reports on Sekoia’s findings attribute the campaign to Russia’s APT29.
How to protect your Android phone?
Both flaws were already patched, so phones running current Chrome and up-to-date security updates stayed safe. Open the Play Store to update Chrome, then check your Android security patch level in Settings.
Attacks built on old, patched bugs only work on neglected phones. Expect more of them, which makes updating the cheapest defence you have.
Pareesa Afreen is a reporter and sub editor specialising in technology coverage, with 3 years of experience. She reports on digital innovation, gadgets, and emerging tech trends while ensuring clarity and accuracy through her editorial role, delivering accessible and engaging stories for a fast-evolving digital audience.
Share this story:
Make us preferred on Google
- 3 gaps left after Snapchat Find Friends goes off for kids
- Snapchat disables ‘Find Friends’ feature by default for UK children, Ofcom says
- EU charges TikTok over harmful content rabbit holes: What to know
- Meta announces major pause in planned updates
- FBI confirms record $6.3 Billion Binance crypto heist linked to North Korea’s elite state-sponsored hackers
- Tesla announces major downsizing of Cybertruck production at Texas gigafactory
- Google, Meta and TikTok take legal fight to California over youth social media law
- Does swearing at AI chatbots get you better answers?
- <img src="https://www.thenews.com.pk/assets/front/images/placeholders/200×120.png" alt="WhatsApp can now expand photos to fit your status screen” title=”WhatsApp can now expand photos to fit your status screen” loading=”lazy”>
WhatsApp can now expand photos to fit your status screen - Starlink Mobile to deploy tens of thousands of 5G sites
- EU AI rules to apply in Northern Ireland: What to know
- Tencent’s new Hy4 AI model Is 2.6 times bigger than Hy3
