EUVD-2025-16700
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Analysis
Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory corruption during graphics rendering. KEV-listed, this vulnerability can be triggered through Chrome on Android devices with Qualcomm chipsets, providing a kernel-level exploitation path from web content.
Technical Context
When Chrome renders graphics on Android devices with Qualcomm Adreno GPUs, it interacts with the kernel-level GPU driver. The use-after-free in the Adreno driver can be triggered by crafted WebGL or Canvas operations in web content. Because the GPU driver runs in kernel context, successful exploitation provides kernel-level access — bypassing Android's app sandbox and all OS-level security.
Affected Products
['Android devices with Qualcomm Adreno GPU running Chrome']
Remediation
Apply Android security patch and update Chrome. Ensure auto-updates are enabled. Enterprise: enforce minimum patch levels via MDM.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today