Table of Contents
No sketchy app, no weird download, no “click here to claim your prize.” Just opening a normal-looking web page in Chrome was enough to get some Android phones hacked.
The good news? Both flaws in this attack were already fixed. The catch is that they only protect you if your phone actually has the fixes. Here’s how the attack worked and the two checks that tell you whether you’re safe.
What happened
Security firm Sekoia published research on a hacking campaign, reported by Android Authority on November 5, 2026. The attackers chained two bugs together on Android:
- CVE-2026-3910, a Chrome flaw used to run code inside the browser. It affected Chrome 139 through 145 on Android.
- CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, used to break out of Chrome’s sandbox. Adreno graphics are built into Snapdragon chips, so Qualcomm-powered phones were the ones at risk.
Once inside, malware Sekoia calls AndroSnitch copied browser cookies, saved logins, browsing history and the phone’s saved Wi-Fi configuration file.
How people landed on the rigged pages
The attackers injected malicious code into legitimate websites and also built convincing lookalikes, including a copy of the America250 site and one imitating a luxury London hotel near UK government offices. A Ukrainian web analytics service used by thousands of sites was compromised from August 27 to September 3. A script then checked each visitor’s device and served a matching exploit.
▲ The whole chain ran without the victim tapping anything beyond opening the page.
Who was targeted
Sekoia links the campaign to APT29, a group tied to Russia’s foreign intelligence service. The targets point to diplomats and people connected to the war in Ukraine. So, realistically, this wasn’t aimed at your average phone owner.
But here’s why it still matters to you: once techniques like this are public, other attackers copy them. And an old phone running old Chrome is the perfect target.
2 checks: are you safe?
| Check | You’re safe if… | Where to look |
|---|---|---|
| 1. Chrome version | It’s newer than 145 | Chrome > three dots > Settings > About Chrome |
| 2. Security update | You have the latest monthly patch for your phone | Settings > Security (or Software update) |
Qualcomm GPU driver fixes reach you through your phone maker’s monthly security updates, not through the Play Store. So even with the newest Chrome, an unpatched phone keeps half the door open.
5 things to do today
- Update Chrome from the Play Store and turn on auto-update for it.
- Install your phone’s latest security update. If it says you’re up to date, check the patch date. Months-old means your phone may be falling behind.
- Retire phones that no longer get updates. An old Snapdragon phone stuck on an ancient patch can never get the GPU fix.
- Sign out of active sessions if you suspect anything. Stolen cookies can let someone into your accounts without your password. Google, Microsoft and most social apps let you sign out all devices from their security settings.
- Change passwords saved in your browser, then turn on two-step verification for your important accounts.
- If your Chrome is current and your phone got a security update in the last month or two, you’re very likely fine.
- Higher risk: work in government, journalism, NGOs or anything Ukraine-related. Consider Android’s Advanced Protection settings and be extra quick with updates.
FAQ
Q. Were iPhones affected too?
A. Sekoia described separate iOS chains: one stole cookies on iOS 16 through 17.4, and another called DarkSword targeted iOS 18.5. Keeping iOS updated is the fix there as well.
Q. Is my Samsung phone affected?
A. Samsung uses Snapdragon chips in many models, so the GPU flaw is relevant. Oddly, the exploit was coded to stop on the Galaxy S25 Ultra. Either way, the fix is the same: update Chrome and install the latest security patch.
Q. What is a zero-click attack?
A. It’s an attack that doesn’t need you to tap, download or approve anything. In this case, simply loading an infected page in an outdated browser was enough.
Q. Do I need antivirus for this?
A. Updates matter far more. Security apps can help spot known malware, but they can’t patch a browser or GPU driver. Only updates can.