Qualcomm Adreno GPU Driver Use-After-Free (CVE-2025-27038)

Historical catalog analysis: CISA added this entry on June 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-27038 is a use-after-free (CWE-416) vulnerability identified in multiple Qualcomm chipsets. The flaw resides within the Adreno GPU drivers and can lead to memory corruption during graphics rendering processes when using the Chrome browser.

Exposure and applicability

This vulnerability affects devices utilizing Qualcomm chipsets equipped with Adreno GPU drivers. Because these components are integrated into a wide variety of hardware, exposure is determined by the specific chipset and driver version deployed on the device. The primary attack vector involves graphics rendering within Chrome, making devices that frequently use this browser for web-based content more susceptible to the memory corruption risk.

Remediation priorities

Our analysis suggests prioritizing remediation based on the following criteria:

1. Hardware Inventory: Identify all fleet assets utilizing Qualcomm chipsets. Since the vulnerability is tied to GPU drivers, mobile devices and embedded systems using Adreno GPUs are the primary focus.
2. OEM Coordination: Because Qualcomm provides the chipset but Original Equipment Manufacturers (OEMs) deliver the final software updates, defenders must cross-reference their hardware list with June 2025 security bulletins from their respective device vendors.
3. Patch Deployment: Prioritize the application of vendor-supplied mitigations as outlined in the June 2025 security updates to address the use-after-free condition.

How to validate remediation

Verifying that a vulnerability is mitigated requires more than a simple version check, as driver versions can vary across different OEM implementations. We recommend the following validation approach:

• Vendor Confirmation: Obtain explicit confirmation from the OEM that the June 2025 security update specifically addresses CVE-2025-27038 for the deployed hardware model.
• Update Verification: Confirm the successful installation of the vendor’s June 2025 patch via system update logs or device management consoles.
• Configuration Audit: Ensure that Chrome is updated to the latest version, as the vulnerability manifests during rendering within that specific application.

Limits and open questions

There are several unknowns regarding this vulnerability. While it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, the status of its use in known ransomware campaigns remains unknown. Additionally, because Qualcomm supports multiple chipsets, the exact list of affected hardware models is not centralized and depends on individual OEM disclosures.

Residual risk remains if a device is end-of-life (EOL) and no longer receives OEM updates, as the vulnerability exists at the driver level. In such cases, the only supported remediation path provided by the source is to discontinue use of the affected product.

Source and editorial note

CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability · Source date: June 03, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 12, 2026 at 00:40 UTC.

Request a Vulnerability Assessment