CVE-2025-27038: high-severity vulnerability in Qualcomm, Inc. Snapdragon
Use After Free in Graphics
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A memory corruption flaw in Chrome's graphics rendering with Adreno GPU drivers allows an attacker to crash the browser or potentially execute malicious code by crafting a specially designed web page.
Use-after-free vulnerability in Adreno GPU driver integration within Chrome's graphics pipeline. Attack vector: malicious webpage with crafted graphics content; requires user to visit the page. Impact: memory corruption leading to denial of service or potential code execution.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.