{"id":"CVE-2025-27038","kind":"vulnerability","aliases":["CVE-2025-27038"],"related":[],"title":"Memory corruption while rendering graphics using Adreno GPU drivers in Chrome","description":"Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A use-after-free bug in Qualcomm Adreno GPU drivers lets memory corruption happen while graphics are rendered in Chrome. CISA lists it as exploited in the wild, so an attacker who gets a crafted page or input to render can likely corrupt memory on the device.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2025-06-03T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8031 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6620 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6640 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca2066 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm6125 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm8550 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn9011 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn9012 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs6125 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs8550 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm video collaboration vc1 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6475 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm6650p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7435 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7635 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sm7635p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm smart audio 400 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 4 gen 2 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 6 gen 1 mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 680 4g mobile platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 685 4g mobile platform \\(sm6225-ad\\) firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon w5\\+ gen 1 wearable platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sw5100 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sw5100p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9335 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9370 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9375 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9378 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9385 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcd9395 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn3950 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn3980 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn3988 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn6650 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn6740 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn6755 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wsa8810 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","chrome","exploited","infrastructure","qualcomm-chipset"],"not_affected_if":["non-qualcomm-hardware"],"how_to_check":null,"fix":"Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2025-06-03T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:59+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:46:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).\nunknown","reach":"unknown","summary":"A use-after-free bug in Qualcomm Adreno GPU drivers lets memory corruption happen while graphics are rendered in Chrome. CISA lists it as exploited in the wild, so an attacker who gets a crafted page or input to render can likely corrupt memory on the device.","category":"infrastructure","who_cares":["android","qualcomm-chipset","chrome"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory corruption on the device, possibly leading to code execution.","analyst_note":"Find the Qualcomm security bulletin and the affected chipset and patch list for CVE-2025-27038 to fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-qualcomm-hardware"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000445,"input_tokens":2563,"output_tokens":378,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':266C '-2025':13A,16A '-27038':14A,17A '1':100A,125A '2':92A '22':265C '4':90A '400':85A '4g':107A,114A '6':98A '680':106A '685':113A '7800':32A 'action':256C 'ad':119A 'adreno':7A,189B,249C 'allow':241C 'android':174B 'appli':257C 'applic':263C 'ar8031':22A 'attack':212B 'audio':84A 'bod':264C 'bug':186B 'chipset':180B,231C 'chipsets':20A 'chrome':11A,175B,201B,253C 'cisa':202B,254C 'cloud':269C 'collaboration':60A 'contain':232C 'corrupt':2A,194B,224B,244C 'craft':216B 'csra6620':25A 'csra6640':28A 'cve':12A,15A 'devic':228B 'discontinu':272C 'driver':9A,191B,251C 'exploit':176B,206B 'fastconnect':31A 'firmware':23A,26A,29A,33A,36A,39A,42A,45A,48A,51A,54A,57A,63A,66A,69A,72A,75A,78A,81A,87A,95A,103A,110A,120A,128A,131A,134A,137A,140A,143A,146A,149A,152A,155A,158A,161A,164A,167A,170A,173A 'follow':262C 'free':185B,237C 'gen':91A,99A,124A 'get':214B 'gpu':8A,190B,250C 'graphic':5A,197B,247C 'guidanc':267C 'happen':195B 'infrastructur':177B 'input':219B 'instruct':261C 'let':192B 'like':223B 'list':203B 'memori':1A,193B,225B,243C 'mitig':258C,278C 'mobile':93A,101A,108A,115A 'multipl':229C 'multiple':19A 'page':217B 'per':259C 'platform':62A,86A,94A,102A,109A,116A,127A 'product':276C 'qca2066':35A 'qca6391':38A 'qcm6125':41A 'qcm8550':44A 'qcn9011':47A 'qcn9012':50A 'qcs6125':53A 'qcs8550':56A 'qualcomm':18A,21A,24A,27A,30A,34A,37A,40A,43A,46A,49A,52A,55A,58A,64A,67A,70A,73A,76A,79A,82A,88A,96A,104A,111A,121A,129A,132A,135A,138A,141A,144A,147A,150A,153A,156A,159A,162A,165A,168A,171A,179B,188B,230C 'qualcomm-chipset':178B 'render':4A,199B,221B,246C 'requir':255C 'servic':270C 'sm6225':118A 'sm6225-ad':117A 'sm6475':65A 'sm6650':68A 'sm6650p':71A 'sm7435':74A 'sm7635':77A 'sm7635p':80A 'smart':83A 'snapdragon':89A,97A,105A,112A,122A 'sw5100':130A 'sw5100p':133A 'unavail':280C 'use':6A,183B,235C,248C,273C 'use-after-fre':182B,234C 'vc1':61A 'vendor':260C 'video':59A 'vulner':238C,240C 'w5':123A 'wcd9335':136A 'wcd9370':139A 'wcd9375':142A 'wcd9378':145A 'wcd9385':148A 'wcd9395':151A 'wcn3950':154A 'wcn3980':157A 'wcn3988':160A 'wcn6650':163A 'wcn6740':166A 'wcn6755':169A 'wearable':126A 'wild':209B 'wsa8810':172A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-03T00:00:00+00:00","kev":{"dateAdded":"2025-06-03","dueDate":"2025-06-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-27038","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-27038","severity":null,"published_at":"2025-06-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-27038","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27038","severity":null,"published_at":"2025-06-03T06:15:27+00:00","modified_at":"2026-06-17T09:02:48+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}