DIGITAL LIFE

Hackers exploited flaws in Chrome and Snapdragon to attack Android smartphones

An investigation by the cybersecurity firm Sekoia has uncovered a cyber-espionage campaign that leveraged vulnerabilities in Google Chrome and Qualcomm’s graphics drivers to compromise Android smartphones. The attack could be executed via an infected webpage, without the need for the user to install any applications or grant additional permissions.

Investigators have linked the operation to the group APT29, which is frequently associated with Russian foreign intelligence services. The primary targets appear to be individuals connected to diplomacy and the conflict in Ukraine, even though the campaign utilized publicly accessible websites.

According to Sekoia’s report, the attack on Android worked in stages. First, it used a Chrome flaw tracked as CVE-2026-3910 to run code inside the browser. It then exploited CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, to break out of Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics are found in Snapdragon chips, phones powered by Qualcomm’s silicon were the ones affected.

The attack only targeted Chrome versions 139 through 145, though it skipped version 143 for reasons Sekoia says are unclear. Once a phone was compromised, the attackers dropped malware that Sekoia calls AndroSnitch. It copied Chrome’s cookies, saved login data, and browsing history, along with the phone’s saved Wi-Fi configuration file, which contains the passwords for networks you’ve connected to. Stolen cookies are especially valuable since they can let attackers slip into accounts that are already signed in.

Interestingly, the Android exploit was coded to stop if it detected a Samsung Galaxy S25 Ultra. Sekoia didn’t name any other phone models or Android versions that were specifically targeted.

The hack reportedly reached victims in several ways. The attackers injected malicious code into legitimate websites, set up lookalike copies of real sites, and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. The fake sites included a copy of the America250 website and one mimicking a luxury London hotel close to UK government offices. A script on these pages profiled each visitor’s device and then served the matching exploit.

Sekoia says the hacking campaign is linked to APT29, a hacking group tied to Russia’s foreign intelligence service. The targets suggest the group was mostly after diplomats and people connected to the war in Ukraine rather than ordinary Android and iOS users. Yes, iPhones were targeted too, with one exploit chain stealing cookies on iOS 16 through 17.4 and the DarkSword exploit grabbing messages, photos, and passwords from devices on iOS 18.5.

The attack combined two distinct vulnerabilities. The first, identified as CVE-2026-3910, affected certain versions of Google Chrome and allowed for the execution of malicious code within the browser.

The second, CVE-2025-27038, was found in the Adreno graphics drivers used in Qualcomm’s Snapdragon processors.

The combination of these flaws made it possible to bypass security protections that typically prevent the browser from accessing sensitive areas of the operating system.

Once a device was compromised, the attackers would install a piece of malicious software identified as "AndroSnitch."

This malware collected data such as saved passwords, browsing history, authentication cookies, and Wi-Fi network settings—including the associated credentials.

The cookies were a particularly valuable target, as they can grant access to already-authenticated accounts without requiring the user to re-enter their password.

The exploit chain targeted Chrome versions 139 through 145, with the exception of version 143.

Legitimate websites were used to distribute the malware; the campaign did not rely solely on fraudulent pages created by the attackers. According to Sekoia, those responsible also compromised legitimate websites and injected malicious code into a Ukrainian traffic analysis service used by thousands of web pages.

This component of the operation was active between August 27 and September 3, 2026.

When a visitor accessed one of the affected pages, a script would analyze the device's features to determine which exploitation technique was most appropriate.

The researchers also identified a curious behavior: the code would automatically abort the attack if it detected a Samsung Galaxy S25 Ultra. The reason for this exclusion remains unknown.

The operation also sought to compromise Apple devices, leveraging other vulnerabilities specific to iOS.

Despite the severity of the campaign, the two flaws used against Android smartphones have already been patched.

Devices running updated versions of Chrome with the relevant security patches installed are protected against this known exploit chain.

It is important to note that the research describes a targeted campaign, not an indiscriminate attack on all Android users.

Nevertheless, this case demonstrates how vulnerabilities in different components can be combined to bypass security mechanisms otherwise considered robust.

Exploiting a flaw in the browser, followed by another in the graphics driver, also illustrates the importance of keeping both applications and the operating system itself up to date.

To reduce exposure to similar attacks, it is recommended to regularly install updates provided by manufacturers, use recent versions of web browsers, and avoid using devices that no longer receive security patches.

Hackers linked to the Russian intelligence group APT29 exploited a combination of browser and hardware flaws to target Android smartphones.

Attack Details:

• Vulnerabilities exploited: The attack combined the CVE-2026-3910 flaw in Google Chrome (within the V8 engine) to execute code in the browser, and the CVE-2025-27038 flaw in the Qualcomm Adreno GPU driver to escape the system's security sandbox.

• Affected devices: Android devices equipped with Qualcomm Snapdragon processors running versions of Chrome between 139 and 145 (excluding version 143). Interestingly, the exploit was programmed to abort if it detected a Samsung Galaxy S25 Ultra.

• Malware deployed: The malicious program, dubbed "AndroSnitch" by the security firm Sekoia, stole session cookies, browsing history, saved passwords, and Wi-Fi network configuration files.

• Infection method: The attack took place via compromised legitimate websites or fake pages that injected JavaScript to profile the device and automatically deliver the exploit. Further details on the operation can be found on Android Authority and Gadgets360.

How to protect your phone:

• Update Google Chrome: Go to the Google Play Store and install the latest version of the browser.

• Install system updates: Check for any pending monthly security patches in your Android device's settings.

mundophone