CVE-2025-27038
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Description
CVE-2025-27038 is a high-severity use-after-free vulnerability in Qualcomm Adreno GPU drivers that manifests when rendering graphics in Chrome. The memory corruption flaw allows a remote attacker to potentially execute arbitrary code on affected devices by crafting malicious web content that triggers the use-after-free condition during GPU rendering operations. With a CVSS v3.1 score of 7.5 (HIGH) and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of June 24, 2025, this vulnerability represents an active threat to devices running Qualcomm chipsets including QCM8550, SM6650, SM7635, and FastConnect 7800 series.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | ar8031 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | qca2066 firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qcm6125 firmware | - |
| qualcomm | qcm8550 firmware | - |
| qualcomm | qcn9011 firmware | - |
| qualcomm | qcn9012 firmware | - |
| qualcomm | qcs6125 firmware | - |
| qualcomm | qcs8550 firmware | - |
| qualcomm | video collaboration vc1 platform firmware | - |
| qualcomm | sm6475 firmware | - |
| qualcomm | sm6650 firmware | - |
| qualcomm | sm6650p firmware | - |
| qualcomm | sm7435 firmware | - |
| qualcomm | sm7635 firmware | - |
| qualcomm | sm7635p firmware | - |
| qualcomm | smart audio 400 platform firmware | - |
References
Weakness Type
CWE-416: Use After Free
CVE-2025-27038 is classified under CWE-416 (Use After Free), a memory safety vulnerability that occurs when software continues to reference memory after it has been freed. In the Qualcomm Adreno GPU driver, the use-after-free condition is triggered during graphics rendering operations in Chrome, where a previously freed memory region is accessed during subsequent rendering passes. This allows an attacker to potentially control the contents of the freed memory and achieve code execution when the stale pointer is dereferenced.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2025-27038 has high impact across all three CIA dimensions with a CVSS score of 7.5. The vulnerability is network-exploitable (AV:N) through malicious web content, though with high attack complexity (AC:H) and requiring user interaction (UI:R) in the form of visiting a crafted webpage. No authentication is required (PR:N) to trigger the vulnerability, and the scope remains unchanged (S:U). Confidentiality (High): The use-after-free can be leveraged to read sensitive data from the device's memory, including credentials, encryption keys, and personal information. Integrity (High): Successful exploitation allows arbitrary code execution, enabling modification of system files, installation of malware, and tampering with application data. Availability (High): Memory corruption from the use-after-free can cause device crashes and system instability. The EPSS score of 1.07% at the 77.44th percentile indicates moderate exploitation probability, placing it above average among all tracked vulnerabilities.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-27038 by including it in the Known Exploited Vulnerabilities catalog, indicating that threat actors are successfully weaponizing this Adreno GPU driver flaw in real-world attacks. The EPSS score of 1.07% at the 77.44th percentile indicates moderate exploitation activity relative to other vulnerabilities. The fact that the vulnerability is triggered through Chrome's graphics rendering pipeline makes it particularly dangerous, as it can be exploited remotely through malicious web content without requiring the victim to install any application. No public proof-of-concept code has been identified in the references, consistent with the typical pattern of GPU driver exploits being closely held by advanced threat actors.
Remediation
-
Apply Qualcomm security patches as described in the Qualcomm June 2025 Security Bulletin. Contact your device OEM to obtain firmware updates addressing the Adreno GPU driver vulnerability for affected chipsets.
-
Update Chrome and Chromium-based browsers to the latest available version on all affected devices, as browser-level mitigations may reduce the exploitability of the GPU driver flaw during rendering operations.
-
Implement web content filtering to block access to known malicious sites and newly registered domains. Deploy DNS-level filtering and network security controls that can reduce the likelihood of users encountering exploit-hosting pages.
-
Monitor for indicators of compromise including unexpected browser crashes during web browsing, abnormal GPU process behavior, unauthorized data access, and unusual network traffic from mobile devices that may indicate post-exploitation activity.
-
Enable automatic updates on all devices using affected Qualcomm chipsets (AR8031, CSRA6620/6640, FastConnect 7800, QCA2066/6391, QCM6125/8550, QCN9011/9012, QCS6125/8550, SM6475/6650/7435/7635) to ensure prompt delivery of security patches.
Technical Details
CVE-2025-27038 is a use-after-free vulnerability in the Qualcomm Adreno GPU driver that is triggered during graphics rendering operations in Chrome. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network exploitation with high attack complexity, requiring user interaction but no privileges. The vulnerability occurs when Chrome's rendering engine submits graphics commands to the Adreno GPU driver, and a specific sequence of operations causes a memory region to be freed while a pointer to that memory is still retained and subsequently dereferenced. The high attack complexity (AC:H) suggests that precise timing or heap manipulation is required to reliably exploit the use-after-free condition, as the attacker must control what data occupies the freed memory slot when the dangling pointer is accessed. The network attack vector is achieved through crafted HTML/WebGL content that triggers the vulnerable rendering code path in Chrome's interaction with the Adreno GPU driver.
Frequently Asked Questions
Is CVE-2025-27038 being actively exploited?
Yes. CVE-2025-27038 has been added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation. The remediation deadline is June 24, 2025. The vulnerability can be triggered remotely through malicious web content.
What products are affected by CVE-2025-27038?
CVE-2025-27038 affects devices using Qualcomm Adreno GPU drivers across chipsets including AR8031, CSRA6620/6640, FastConnect 7800, QCA2066/6391, QCM6125/8550, QCN9011/9012, QCS6125/8550, SM6475/6650/6650P/7435/7635/7635P, Video Collaboration VC1 Platform, and Smart Audio 400 Platform.
How do I fix CVE-2025-27038?
Apply firmware updates from your device manufacturer incorporating the Qualcomm June 2025 Security Bulletin patches. Additionally, keep Chrome updated to the latest version and implement web content filtering to reduce exposure to malicious pages.
How severe is CVE-2025-27038?
CVE-2025-27038 has a CVSS v3.1 score of 7.5 (HIGH). It is remotely exploitable through malicious web content, though with high attack complexity. The EPSS score of 1.07% at the 77.44th percentile indicates above-average exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.