CVE DatabaseCVE-2025-27038

Updated 2026-06-17한국어 권고문 →

CVE-2025-270387.5/HIGHCISA KEVCWE-416

Qualcomm Adreno GPU Driver Memory Corruption Vulnerability (CVE-2025-27038) Technical Advisory

⚡ Jump to Patch

Affected Vendors

qualcomm, google

Affected Components

adreno gpu driver, chrome

Published Date

2025-06-03

CVSS v3.1

7.5

HIGH

EPSS (30d)

1.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Android devices equipped with Qualcomm Adreno GPU drivers and running Google Chrome browser

Impact

Remote attackers can exploit GPU rendering pipelines to trigger memory corruption, potentially leading to sandbox escape and arbitrary code execution

Mitigation

Apply the latest security patches released by Qualcomm and device OEMs, and update Google Chrome to the latest version

Affected Products & Version Scope

Devices utilizing Qualcomm Adreno GPU drivers running Google Chrome browser

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest system updates provided by Qualcomm and your device manufacturer (OEM). For managed Android fleets, ensure Google Chrome is updated to the latest version using ADB or MDM solutions.

bash

# Force check and trigger Google Chrome update on connected Android device via ADB
adb shell am start -a android.intent.action.VIEW -d 'market://details?id=com.android.chrome'

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, mitigate the risk by disabling hardware acceleration and WebGL APIs within Chrome to reduce the attack surface.

bash

# Example of enforcing Chrome policy to disable WebGL via managed policy configuration
# Add the following JSON structure to your Chrome enterprise policy configuration
{
  'Disable3DAPIs': true,
  'WebGLBlockedForUrls': ['*']
}

3. Log Audit & IoC Verification Commands

Monitor system logs for unusual GPU driver crashes or segmentation faults that may indicate exploitation attempts targeting the Adreno driver.

bash

# Filter Android logcat output for Adreno GPU driver crashes and memory faults
adb logcat | grep -Ei 'adreno|kgsl|fatal signal 11|address boundary error'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active in-the-wild exploitation (CISA KEV), immediately apply the latest OEM system updates and upgrade Google Chrome to mitigate this high-severity risk.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2025-27038 is a critical memory corruption vulnerability that occurs while rendering graphics using Qualcomm Adreno GPU drivers within the Google Chrome browser environment. Classified under Use-After-Free (CWE-416), the root cause lies in improper lifecycle management of GPU memory resources, allowing the driver to reference memory addresses that have already been deallocated.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by hosting a malicious web page containing crafted WebGL or WebGPU rendering instructions. When a victim visits the page via Chrome, the browser's renderer process interacts with the Adreno GPU driver to allocate and prematurely free specific graphics contexts or buffer objects. By reclaiming the freed memory space with attacker-controlled data (e.g., via heap spraying), the attacker can hijack the control flow when the driver attempts to reuse the stale pointer, leading to privilege escalation or arbitrary code execution.

3. Infrastructure & Business Impact

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. In an enterprise environment, a successful exploit on an employee's mobile device can bypass browser sandboxes, compromise the endpoint, and serve as an entry point for lateral movement, data exfiltration, and unauthorized access to corporate networks.

Official Vendor Advisories & References

NVD Original English Description

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html

Source: product-security@qualcomm.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27038

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-27038)

FAQ

Q1. How critical is CVE-2025-27038 and is it actively exploited in the wild?

CVE-2025-27038 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 1.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-27038?

Primary impacted vendors include qualcomm, google across adreno gpu driver, chrome. Scope summary: Devices utilizing Qualcomm Adreno GPU drivers running Google Chrome browser

Q3. What temporary mitigations or workarounds exist for CVE-2025-27038 before patching?

[Mitigation] Apply the latest security patches released by Qualcomm and device OEMs, and update Google Chrome to the latest version Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION