Android Chrome security: What an infected webpage could expose

By TechnoRapper editorial desk. This is an attributed analysis of the linked source, not original reporting or an independent test.

Android Chrome security depends on keeping the browser and phone updated: researchers say attackers chained a Chrome flaw with a Qualcomm Adreno driver bug to target phones that opened infected websites. The campaign could steal sensitive data without asking victims to tap a link, install an app, or approve a permission, but both vulnerabilities had been patched.

What changed

Researchers at security firm Sekoia described a mobile hacking campaign that used hijacked and fake websites to target Android and iPhone users. On Android, the reported route combined two vulnerabilities rather than relying on a victim to install a malicious app.

First, attackers used CVE-2026-3910, a flaw in Chrome, to run code inside the browser. They then exploited CVE-2025-27038 in Qualcomm’s Adreno GPU driver to escape Chrome’s sandbox and gain deeper access to the phone, according to Sekoia’s report.

The campaign targeted Chrome versions 139 through 145 on Android, the source says. Since Adreno graphics are found in Snapdragon chips, the described driver exploit applied to phones using Qualcomm silicon. The report does not identify specific phone models or manufacturers.

That sequence matters: the browser vulnerability opened the first door, while the GPU-driver flaw helped attackers move beyond the browser’s restrictions. The source says both flaws had already been patched, meaning this account describes a threat against affected software rather than evidence that every Android phone remains exposed.

Why it matters

A malicious webpage is a different kind of risk from a conventional attack that asks someone to download an app or grant access. In this campaign, simply opening an infected page in an outdated Chrome version could trigger the exploit chain, so a user might not see an obvious warning or permission request before the attempt began.

The reported data at risk included browser cookies, saved logins, browsing history, and Wi-Fi passwords. Those details can reveal account access or personal activity, although the source does not say how many victims were affected or whether every targeted device lost all of these data types.

For Android users, the practical lesson is to treat browser updates and device security updates as parts of the same protection routine. A browser patch can close the first vulnerability, while a system or driver-related update may address the deeper component involved in an exploit chain. The source does not specify the patch versions or give a device-by-device update list.

This is also a reminder that security boundaries work in layers. Chrome’s sandbox is intended to limit what browser code can reach; the reported use of a separate Adreno driver flaw shows why attackers may seek another vulnerability when they want access beyond that boundary.

Who is affected

The people most directly at risk were Android users running a targeted Chrome version on phones whose Qualcomm Adreno graphics driver remained vulnerable, and who visited a compromised or fake website. The source identifies the Chrome range as versions 139 to 145 but does not list affected Snapdragon chipsets or Android models.

Users of other Android phones should not assume that this exact Qualcomm driver exploit applied to their hardware. However, the report’s browser flaw and the importance of installing available security updates remain relevant reminders for anyone using Chrome on Android. The source does not provide enough detail to assess risk for each non-Qualcomm device.

Sekoia also said the wider campaign targeted iPhone users through hijacked and fake websites. The supplied account does not describe the iPhone exploit chain, affected iOS versions, or what data attackers could obtain there, so those details remain uncertain.

For readers comparing Android devices, the story is not a reason to judge a phone by its chipset alone. Qualcomm’s Adreno driver was one part of this specific chain; patch availability and whether a device has installed relevant updates are the more useful questions to check. Our coverage of Qualcomm’s wider mobile technology work offers a separate look at the company’s role in connected devices.

What to watch next

First, check whether Chrome and your Android device have updates available, then install them through their normal update settings. The source confirms that both flaws were patched, but it does not name the exact fixed releases, so readers should rely on updates offered for their own phone rather than assume a particular version number is sufficient.

Next, watch for clearer guidance from device makers or security researchers identifying affected models and patch status. Sekoia’s account, as provided here, establishes the exploit sequence and targeted Chrome range but leaves those device-level details open.

Finally, remain cautious with unfamiliar webpages, especially when a device is behind on updates. That advice does not mean every suspicious page uses this exploit; it reflects the reported possibility that visiting a booby-trapped site could be enough on vulnerable software. The source does not say how the campaign selected or reached its targets.

For users following Android software changes, browser protection sits alongside the operating-system update cycle rather than replacing it. Our report on the reported next Samsung One UI beta covers a separate software-update story, while this incident underscores why security fixes deserve attention too.

Frequently asked questions

Can an Android phone be hacked just by opening a website?

In the campaign described by Sekoia, opening a booby-trapped page in an affected, outdated Chrome version could start an exploit chain without a tap, app installation, or permission approval. The source says both flaws had been patched, so it does not indicate that updated phones remain vulnerable to this particular chain.

Which Android phones were targeted by the reported flaw?

The account points to phones using Qualcomm Adreno graphics, found in Snapdragon chips, and Chrome versions 139 to 145 on Android. It does not name specific phone models or Adreno chipsets, so it cannot establish a complete device list.

What should Android users do after this report?

Install available Chrome and Android security updates, since the source says both exploited flaws had been patched. It does not provide fixed version numbers or model-specific instructions, so check updates for your own device.

Source: Android Authority

How we used the source: facts, quotes, and numbers below come only from that link. We added structure, search intent, and reader context. We did not independently verify the reporting.