CVE-2025-27038

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 1.04%
EPSS Percentile: 64.16%
CISA KEV: YES — Known Exploited Vulnerability

Description

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 03-Jun-2025 13:15
Last Modified: 17-Jun-2026 16:02
EPSS Date: 2026-11-03
CWE: CWE-416

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-06-03
Remediation Due: 2025-06-24
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-27038

CNA Products / Version Status

Qualcomm, Inc. · Snapdragon Source: CNA · [email protected]
Default status: unaffected

AR8031 — affected
CSRA6620 — affected
CSRA6640 — affected
FastConnect 7800 — affected
QCA2066 — affected
QCA6391 — affected
QCM6125 — affected
QCM8550 — affected
QCN9011 — affected
QCN9012 — affected
QCS6125 — affected
QCS8550 — affected
Qualcommr Video Collaboration VC1 Platform — affected
SM6475 — affected
SM6650 — affected
SM6650P — affected
SM7435 — affected
SM7635 — affected
SM7635P — affected
Smart Audio 400 Platform — affected
Snapdragon 4 Gen 2 Mobile Platform — affected
Snapdragon 6 Gen 1 Mobile Platform — affected
Snapdragon 680 4G Mobile Platform — affected
Snapdragon 685 4G Mobile Platform (SM6225-AD) — affected
Snapdragon W5+ Gen 1 Wearable Platform — affected
SW5100 — affected
SW5100P — affected
WCD9335 — affected
WCD9370 — affected
WCD9375 — affected
WCD9378 — affected
WCD9385 — affected
WCD9395 — affected
WCN3950 — affected
WCN3980 — affected
WCN3988 — affected
WCN6650 — affected
WCN6740 — affected
WCN6755 — affected
WSA8810 — affected
WSA8815 — affected
WSA8830 — affected
WSA8832 — affected
WSA8835 — affected

Platforms: Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Affected Products / Versions

qualcomm / ar8031_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*
qualcomm / csra6620_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*
qualcomm / csra6640_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*
qualcomm / fastconnect_7800_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*
qualcomm / qca2066_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*
qualcomm / qca6391_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*
qualcomm / qcm6125_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*
qualcomm / qcm8550_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:*
qualcomm / qcn9011_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*
qualcomm / qcn9012_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*
qualcomm / qcs6125_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*
qualcomm / qcs8550_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*
qualcomm / video_collaboration_vc1_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / sm6475_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm6475_firmware:-:*:*:*:*:*:*:*
qualcomm / sm6650_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:*
qualcomm / sm6650p_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*
qualcomm / sm7435_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*
qualcomm / sm7635_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:*
qualcomm / sm7635p_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*
qualcomm / smart_audio_400_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / snapdragon_4_gen_2_mobile_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / snapdragon_6_gen_1_mobile_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / snapdragon_680_4g_mobile_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware:-:*:*:*:*:*:*:*
qualcomm / snapdragon_w5\+_gen_1_wearable_platform_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*
qualcomm / sw5100_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*
qualcomm / sw5100p_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9335_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9370_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9375_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9378_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9385_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*
qualcomm / wcd9395_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn3950_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn3980_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn3988_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn6650_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn6740_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*
qualcomm / wcn6755_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*
qualcomm / wsa8810_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*
qualcomm / wsa8815_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*
qualcomm / wsa8830_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*
qualcomm / wsa8832_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*
qualcomm / wsa8835_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*

References

Last enrichment sync: 04-Nov-2026 19:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-3910, CVE-2025-27038. Android Chrome cookies and Wi-Fi passwords. Sekoia Details APT29-Linked Watering-Hole Campaign Using Patched Mobile Exploits
CVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143). Sekoia Links Watering-Hole Campaign Using N-Day Exploits to APT29

CVE (7)

Malware (1)

Threat Actors (3)

MITRE ATT&CK (15)

Vendors (3)

Products (9)

Tools (1)

Industries (4)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.