Snapdragon vulnerability hit Android phones: is yours patched?

The Android attack chained two separate flaws, one in the browser and one in the phone’s chip software. Neither was new.

• CVE-2026-3910 is a bug in V8, the part of Chrome that runs JavaScript. A booby-trapped page could use it to run its own code, but only inside Chrome’s sandbox, the walled-off area that is meant to stop a bad web page from reaching the rest of the phone.
• CVE-2025-27038 is a memory-corruption bug in Qualcomm’s Adreno graphics driver. Adreno is the graphics processor built into Snapdragon chips. The attackers used this flaw to climb out of Chrome’s sandbox and get deeper access to the phone.

That second step is why Snapdragon phones were the ones affected. Phones with other chipsets don’t run the Adreno driver, so the escape route didn’t exist for them.

The attack was picky about who it hit. It was only served to Chrome versions 139 through 145, and Sekoia says version 143 was deliberately left out, for reasons nobody has explained. The code also checked the phone’s model number and stopped if it found SM-S938B, the model code of the Galaxy S25 Ultra.

Once inside, the malware, which Sekoia calls AndroSnitch, grabbed Chrome’s cookies, saved logins and browsing history. It also copied the system file where Android keeps saved Wi-Fi passwords.

Cookies matter more than they sound. They are the small files that keep you signed in to email, social media and work tools, so a stolen cookie can let someone use an account without ever knowing the password.

The malware didn’t stick around. None of the payloads installed anything that survives a restart. It collected the data, sent it out and left. A reboot ends any running attack, though visiting an infected site again on the same old software would start it over.

AndroSnitch closely resembles ANDROSNATCH, a Chrome cookie stealer Google documented in 2024 in a suspected APT29 campaign against visitors to Mongolian government websites. That overlap is part of why Sekoia points at the same group.

Victims didn’t need to visit anything shady. The attackers used three routes to reach them.

1. Hacked real websites. Malicious JavaScript was slipped into legitimate sites. The investigation began with the site of a Ukrainian gas production company and later turned up an Australian medical clinic, a far-right movement in the Czech Republic, a Bulgarian site with military ties and a group that speaks for US chemical makers.
2. Lookalike sites. Two clones passed real pages through while adding the attack code. One copied America250, the US initiative marking 250 years of independence. The other copied the website of Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street.
3. A poisoned analytics tool. For one week, from August 27 to September 3, the attackers controlled the tracking script of Plerdy, a Ukrainian website analytics service. That script loads on thousands of websites, most of them Ukrainian, including army and military equipment sites.

Every route led to the same first step: a script that quietly profiled your browser and device, then served the matching exploit. Ukraine was the main focus, with victims also in Europe and the US. Sekoia hasn’t said how many phones were actually broken into, and it is working with national cyber response teams, including Ukraine’s CERT-UA, to find victims.

Your phone was only exposed if both halves of the chain were open: an old Chrome and an old security patch on a Snapdragon phone. Google fixed the Chrome flaw in Chrome 146, released in March 2026. The Adreno fix was listed in Qualcomm’s June 2025 security bulletin, but phone makers ship Qualcomm’s fixes on their own timetables.

That leads to the uncomfortable part. A phone whose last security patch is older than June 2025 may never receive the Adreno fix, because its maker has stopped sending updates. For those owners, updating Chrome still matters a lot, since it shuts the browser half of the chain and the attack needs both.

Here is how to check, using Google’s own steps.

Check and update Chrome

1. Open Chrome, tap More at the top right, then go to Settings and About Chrome. You want version 146 or newer.
2. To update, open the Play Store, tap your profile icon, choose Manage apps & device, find Chrome under the available updates and tap Update.

Check your Android security patch

1. Open Settings, tap About phone (or About tablet) and then Android version. Look at the Android security update date.
2. To install anything waiting, open Settings, then System and Software updates, and follow the prompts. Menu names vary by brand.

Pixel phones download updates in the background, and they take effect the next time you restart. On other brands, update timing depends on the manufacturer and carrier.

The same infected sites served iPhone visitors their own exploit chains. One targeted iOS 16.7 and stole Safari cookies. A second, built on the DarkSword exploit kit, targeted iOS 18.5 and pulled far more: messages, WhatsApp and Telegram data, Keychain passwords, location and photos.

Every flaw in all three chains, Android and iPhone alike, had been fixed before the campaign started. Sekoia’s own bottom line is that anyone on fully updated software was safe. It also warns that spyware-grade exploit kits like DarkSword are being reused by government hackers, which makes old, unpatched phones cheaper and easier targets than they used to be.