Open a website—and lose passwords: researchers uncover attacks on Android smartphones
Attackers combined vulnerabilities in Chrome and the Qualcomm Adreno graphics driver. On unpatched devices, infection could occur by visiting a prepared web page
Specialists from Sekoia discovered a campaign of attacks on mobile devices through compromised websites and fake web resources. For Android, a chain of two already known vulnerabilities was used.
The first, CVE-2026-3910, allowed code execution inside Chrome. The second, CVE-2025-27038 in the Qualcomm Adreno driver, was used to escape the browser's protective sandbox and gain additional privileges.
After the breach, the AndroSnitch malware collected cookies, saved credentials, and Chrome history, as well as Wi-Fi configurations with network passwords.
The attackers' server selected malicious code for Chrome versions 139–145, excluding 143. This describes the settings of a specific campaign, not confirmation of the security of the skipped version.
For distribution, compromised web analytics services and legitimate websites were used, among other methods. Within the same campaign, separate attack chains were employed against iPhones.
Researchers link the operation to APT29. The vulnerabilities used already had fixes: for protection, it is important to update not only Chrome but also the smartphone's system software, including security updates from the manufacturer.
