Edgar Cervantes / Android Authority
Add Android Authority to Google:
TL; DR
- A security firm found that hackers exploited a Chrome bug and a Qualcomm Adreno GPU driver flaw to infect Android phones that visited a booby-trapped website.
- The attack targeted Chrome versions 139 to 145 on Android and stole browser cookies, saved logins, browsing history and Wi-Fi passwords.
- Both flaws have already been patched, so phones with current Chrome and security updates will remain safe.
Security researchers at Sekoia detailed a mobile hacking campaign that went after Android and iPhone users through hijacked and fake websites. On Android, attackers didn’t need a victim to tap a link, install an app, or give a permission. Opening an infected page in an old version of Chrome was enough.
According to Sekoia’s report, the attack on Android worked in stages. First, it used a Chrome bug tracked as CVE-2026-3910 to run code in the browser. It then exploited CVE-2025-27038, a flaw in Qualcomm’s Adreno GPU driver, to break out of Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics have been found in Snapdragon chips, phones with Qualcomm silicon have been the most affected.
The attack only targeted Chrome versions 139 to 145, although it skipped version 143 for reasons, Sekoia says, are unclear. Once a phone was compromised, the attackers dropped malware that Sekoia calls AndroSnitch. It copied Chrome’s cookies, saved credentials and browsing history, along with the phone’s saved Wi-Fi configuration file, which contains the passwords for networks you’re connected to. Stolen cookies are especially valuable because they allow attackers to slip into accounts that are already logged in.
Interestingly, the Android exploit was coded to stop when it detected a Samsung Galaxy S25 Ultra. Sekoia did not name other phone models or Android versions that were specifically targeted.
The hack is said to have reached victims in several ways. The attackers injected malicious code into legitimate websites, set up lookalike copies of real sites and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. A script on these pages profiles the device of each visitor and then serves the appropriate exploit.
Sekoia says the hacking campaign is linked to APT29, a hacking group tied to Russia’s foreign intelligence service. The targets suggest that the group was mostly close to diplomats and people connected to the war in Ukraine rather than ordinary Android and iOS users. Yes, iPhones were also targeted, with an exploit chain that steals cookies on iOS 16 to 17.4 and the DarkSword exploit grabs messages, photos and passwords from devices on iOS 18.5.
The good news is that every flaw used in this hacking campaign was already patched before the attacks began.
To make sure you stay protected, update Chrome from the Play Store and check that you’re on a newer version than 145 by opening the Chrome menu and going to Settings > About Chrome. It’s also worth installing the latest security updates for your phone, as fixes for Qualcomm’s GPU drivers are delivered through these monthly patches.