What is the CVSS score of CVE-2025-27038?

CVE-2025-27038 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Fastconnect 7800 Firmware are affected by CVE-2025-27038?

CVE-2025-27038 is an actively exploited memory corruption vulnerability affecting Chrome users with Adreno GPU drivers, posing immediate risk of system compromise through malicious graphics…

Is CVE-2025-27038 being actively exploited?

Yes, CVE-2025-27038 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-27038?

Within 24 hours: inventory Chrome deployments with Adreno GPU drivers (primarily Qualcomm-based Android and some Windows devices); communicate elevated risk to affected users. Within 7 days: disable GPU acceleration in Chrome for high-risk user groups; enforce browser sandboxing and restrict access to untrusted websites. Within 30 days: prepare rapid deployment of patch upon vendor release; consider alternative browsers for critical workflows; implement enhanced endpoint monitoring for exploitation attempts.

Fastconnect 7800 Firmware CVE-2025-27038

EUVD-2025-16700 HIGH

Use After Free (CWE-416)

2025-06-03 product-security@qualcomm.com

Memory Corruption Google Denial Of Service Fastconnect 7800 Firmware Smart Audio 400 Platform Firmware Wcn3988 Firmware Qcm8550 Firmware Qcs6125 Firmware Sw5100p Firmware Qcs8550 Firmware Sm7635p Firmware Sm6650p Firmware Wsa8810 Firmware Wcd9385 Firmware Sw5100 Firmware Wcn3950 Firmware Wcn3980 Firmware Snapdragon 4 Gen 2 Mobile Platform Firmware Sm6475 Firmware Csra6620 Firmware Wcn6650 Firmware Wsa8832 Firmware Sm7635 Firmware Qcn9011 Firmware Wcd9370 Firmware Wsa8835 Firmware Ar8031 Firmware Sm6650 Firmware Sm7435 Firmware Wcd9335 Firmware Snapdragon 680 4g Mobile Platform Firmware Wcn6740 Firmware Csra6640 Firmware Wcd9395 Firmware Wcn6755 Firmware Qcm6125 Firmware Qcn9012 Firmware Qca6391 Firmware Video Collaboration Vc1 Platform Firmware Qca2066 Firmware Wsa8815 Firmware Wsa8830 Firmware Wcd9378 Firmware Wcd9375 Firmware Snapdragon 6 Gen 1 Mobile Platform Firmware Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16700

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

Added to CISA KEV

Oct 27, 2025 - 17:10 cisa

CISA KEV

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 7.5

DescriptionCVE.org

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

AnalysisAI

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory corruption during graphics rendering. KEV-listed, this vulnerability can be triggered through Chrome on Android devices with Qualcomm chipsets, providing a kernel-level exploitation path from web content.

Technical ContextAI

When Chrome renders graphics on Android devices with Qualcomm Adreno GPUs, it interacts with the kernel-level GPU driver. The use-after-free in the Adreno driver can be triggered by crafted WebGL or Canvas operations in web content. Because the GPU driver runs in kernel context, successful exploitation provides kernel-level access — bypassing Android's app sandbox and all OS-level security.