Android phones faced serious Chrome and Snapdragon security flaws. Discover how the attack worked, what data was at risk and how to protect your device.
Table of Contents
A cybersecurity company has discovered that attackers could break into a vulnerable mobile phone without its owner having to do anything more than load a web page.
All of us who have mobile phones are constantly accessing different websites that have nothing to make you suspect that they can be dangerous. Also, keeping your security in mind, you don’t click on anything weird to avoid potential hacks. Well, it seems that even then we are not safe.
Research by cybersecurity firm Sekoia has found that you’re still in danger. They have found two security flaws, one in Google Chrome and one in Qualcomm’s Adreno graphics drivers.
By taking advantage of both, they could bypass browser protections and access all kinds of private information on the mobile.
The good news is that this, once known, has been corrected with updates, but that does not mean that all phones are protected. If your Android doesn’t have patches installed yet, it doesn’t hurt to take a look and see if you have any pending updates.
How could your Android be hacked just by entering a website?
Here the user did not need to download an application or click on some strange link within the page. It was enough for the browser to load a website prepared to take advantage of security flaws.
The first, identified as CVE-2026-3910, was in V8, the Chrome engine that is responsible for executing JavaScript, that is, what allows pages to have interactive elements and work.
The problem is that this flaw allowed malicious code to be executed within the Chrome process itself.
However, this did not achieve much, since Chrome has a protection called sandbox, which simply isolates web pages to prevent them from accessing the rest of the browser or mobile.
This is where the second flaw came into play, identified as CVE-2025-27038. In this case, the problem was with Qualcomm’s Adreno graphics controller, which many Android phones use.
By exploiting this vulnerability, attackers could bypass that Chrome protection and get the attack going for good. That’s why they needed to combine the two flaws: one allowed them to execute code in the browser and the other helped them bypass Chrome’s barriers.
As it has been known, it seems that, specifically, they were looking for versions of Chrome that were between 139 and 145, with the exception of 143. In addition, it stopped the attack by detecting a Samsung Galaxy S25 Ultra with the code SM-S938B.
As for the information they could have access to, there were Chrome cookies, saved login information, and browsing history.
Although in this case we are not talking about addresses or ID, if an attacker manages to steal one of these cookies and it is still active, they can try to use it to access your account without needing to know your password. But that’s not all, because they could also access all kinds of WiFi settings, including your password.
What you need to update to protect your Android phone
As mentioned before, all this has already been corrected. With this in mind, what you should do is open Google Play, search for Google Chrome, and see if you have any pending updates. Install the newest version available for your mobile.
Then, go into the Android settings and look for the software update or system update section. Again, check if you have any security patches and install them.
Q1: How could attackers hack an Android phone just by having the user load a web page?
A1: Attackers used a website prepared to exploit two security flaws. The user did not need to download an app or click a strange link. Simply having the browser load the page was enough.
Q2: Which two security flaws did Sekoia discover, and where were they located?
A2: The first, CVE-2026-3910, was in V8, the Chrome engine that executes JavaScript. The second, CVE-2025-27038, was in Qualcomm’s Adreno graphics drivers, which many Android phones use.
Q3: Why did the attackers need to combine both flaws?
A3: The Chrome flaw let malicious code run inside the Chrome process, but Chrome’s sandbox, which isolates web pages from the rest of the browser and phone, limited what that code could do. The Adreno flaw let attackers bypass the sandbox so the attack could continue.
