Executive brief
A security vulnerability exists in the graphics drivers for several Qualcomm chipsets used in mobile devices and wearables. This flaw can be triggered while rendering graphics in the Chrome web browser, potentially allowing an attacker to compromise the device. This vulnerability is known to have been exploited in the wild, making it a high priority for patching to protect user data and device integrity.
Technical details
A use-after-free (UAF) vulnerability (CWE-416) exists in Qualcomm Adreno GPU drivers. The flaw is triggered during graphics rendering within the Chrome browser, leading to memory corruption. While the attack requires a high complexity (AC:H) and user interaction (UI:R), such as visiting a malicious website, it can result in full compromise of confidentiality, integrity, and availability. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Patches are available via Qualcomm's June 2025 security bulletin.
Affected products
- Qualcomm Adreno GPU Driver Multiple chipsets including Snapdragon 4/6 Gen 1/2, FastConnect 7800, and others
Timeline
- 2025-06-03: disclosed
- 2025-06-03: advisory
- 2025-06-03: kev added: Added to CISA KEV catalog
- 2025-06-03: exploited