EUVD-2025-16700CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
AnalysisAI
Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory corruption during graphics rendering. KEV-listed, this vulnerability can be triggered through Chrome on Android devices with Qualcomm chipsets, providing a kernel-level exploitation path from web content.
Technical ContextAI
When Chrome renders graphics on Android devices with Qualcomm Adreno GPUs, it interacts with the kernel-level GPU driver. The use-after-free in the Adreno driver can be triggered by crafted WebGL or Canvas operations in web content. Because the GPU driver runs in kernel context, successful exploitation provides kernel-level access — bypassing Android's app sandbox and all OS-level security.
RemediationAI
Apply Android security patch and update Chrome. Ensure auto-updates are enabled. Enterprise: enforce minimum patch levels via MDM.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenti
Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circum
Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app send
Share
External POC / Exploit Code
Leaving vuln.today