Live › vulnerability › CVE-2025-27038
Go to dashboardA use-after-free bug in Qualcomm Adreno GPU drivers lets memory corruption happen while graphics are rendered in Chrome. CISA lists it as exploited in the wild, so an attacker who gets a crafted page or input to render can likely corrupt memory on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Qualcomm Multiple Chipsets | vendor | – | – |
| qualcomm ar8031 firmware | vendor | – | – |
| qualcomm csra6620 firmware | vendor | – | – |
| qualcomm csra6640 firmware | vendor | – | – |
| qualcomm fastconnect 7800 firmware | vendor | – | – |
| qualcomm qca2066 firmware |
| vendor |
| – |
| – |
| qualcomm qca6391 firmware | vendor | – | – |
| qualcomm qcm6125 firmware | vendor | – | – |
| qualcomm qcm8550 firmware | vendor | – | – |
| qualcomm qcn9011 firmware | vendor | – | – |
| qualcomm qcn9012 firmware | vendor | – | – |
| qualcomm qcs6125 firmware | vendor | – | – |
| qualcomm qcs8550 firmware | vendor | – | – |
| qualcomm video collaboration vc1 platform firmware | vendor | – | – |
| qualcomm sm6475 firmware | vendor | – | – |
| qualcomm sm6650 firmware | vendor | – | – |
| qualcomm sm6650p firmware | vendor | – | – |
| qualcomm sm7435 firmware | vendor | – | – |
| qualcomm sm7635 firmware | vendor | – | – |
| qualcomm sm7635p firmware | vendor | – | – |
| qualcomm smart audio 400 platform firmware | vendor | – | – |
| qualcomm snapdragon 4 gen 2 mobile platform firmware | vendor | – | – |
| qualcomm snapdragon 6 gen 1 mobile platform firmware | vendor | – | – |
| qualcomm snapdragon 680 4g mobile platform firmware | vendor | – | – |
| qualcomm snapdragon 685 4g mobile platform \(sm6225-ad\) firmware | vendor | – | – |
| qualcomm snapdragon w5\+ gen 1 wearable platform firmware | vendor | – | – |
| qualcomm sw5100 firmware | vendor | – | – |
| qualcomm sw5100p firmware | vendor | – | – |
| qualcomm wcd9335 firmware | vendor | – | – |
| qualcomm wcd9370 firmware | vendor | – | – |
| qualcomm wcd9375 firmware | vendor | – | – |
| qualcomm wcd9378 firmware | vendor | – | – |
| qualcomm wcd9385 firmware | vendor | – | – |
| qualcomm wcd9395 firmware | vendor | – | – |
| qualcomm wcn3950 firmware | vendor | – | – |
| qualcomm wcn3980 firmware | vendor | – | – |
| qualcomm wcn3988 firmware | vendor | – | – |
| qualcomm wcn6650 firmware | vendor | – | – |
| qualcomm wcn6740 firmware | vendor | – | – |
| qualcomm wcn6755 firmware | vendor | – | – |
| qualcomm wsa8810 firmware | vendor | – | – |
Unknown from the sources.
Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-27038")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.