Security firm Sekoia has found that an outdated copy of Chrome on an unpatched Snapdragon Android phone was all attackers needed. Opening a booby-trapped website let them steal Chrome cookies, saved logins, browsing history and saved Wi-Fi passwords. The victim didn’t have to tap anything, install an app or grant a permission.
Sekoia links the campaign to APT29 and rates its confidence in that call as moderate to high. It describes APT29 as a Russia-nexus group widely attributed to Russia’s SVR intelligence service. The good news is that both Android flaws were patched months ago. Fully updated phones are not at risk.
How the Chrome Snapdragon exploit worked
The Android chain paired two known bugs. The first, CVE-2026-3910, is a flaw in Chrome’s V8 engine that lets a crafted web page run code inside the browser’s sandbox. The second is CVE-2025-27038, a memory-corruption bug in Qualcomm’s Adreno GPU driver. The attackers used it to break out of Chrome’s sandbox.
Sekoia says the exploit was only served to Chrome versions 139 through 145, with version 143 explicitly excluded. Once inside, it copied Chrome’s cookie, login and history files. It also took the system file that stores saved Wi-Fi passwords. The code checks the phone model and stops if it detects SM-S938B, the Galaxy S25 Ultra. None of the payloads persist on the device. They grab the data and leave.
Attackers reached victims in three ways. Some legitimate websites had malicious JavaScript injected into them. Others were cloned through reverse proxies, such as america250[.]holiday, a copy of America250.org. Another clone, theowo[.]club, mimicked the website of the Raffles London at The OWO hotel.
The third route was a week-long compromise of Plerdy, a Ukrainian analytics tracker, from August 27 to September 3. That put the attack code on thousands of mostly Ukrainian websites.
Victims were spread across Europe and the US, with Ukraine the main focus. Compromised sites included a US chemical-industry trade association, a Bulgarian military-related site, a far-right Czech movement’s site and an Australian medical clinic. Sekoia’s report doesn’t give a count of infected users.
iPhones were targeted too
The same sites served iPhone visitors two exploit chains of their own. One targeted iOS 16.7 and took cookies. The other targeted iOS 18.5 and pulled far more data. That included messages, WhatsApp and Telegram databases, Keychain entries, photos and location. The iPhone exploits include the DarkSword remote code execution exploit, and we’ve covered DarkSword-based iPhone spyware before.
Is your phone safe? What to check
Sekoia stresses that none of these were zero-days. Every chain relied on publicly known bugs that already had fixes. The TDR team put it plainly in its report:
This operation targets unpatched devices using n-days; a user running an up-to-date operating system is safe from these attacks.
Google fixed the V8 flaw in Chrome 146, released in March 2026. NVD lists Qualcomm’s June 2025 security bulletin as the fix for the Adreno driver bug. Phone makers ship Qualcomm fixes on their own schedules, so check both pieces:
- Open Chrome and go to Settings > About Chrome. Confirm it shows version 146 or later.
- Update Chrome from the Google Play Store if it’s older.
- Check your Android security patch level in your phone’s Settings. The exact menu varies by brand.
- Install any pending system or security update.
This isn’t the first time Chrome for Android has needed an urgent fix, as with an earlier V8 flaw Google said was exploited. The weak point here is old software, not a new bug. A phone whose last security patch predates June 2025 may never get the Adreno fix. That is a real cost of short update windows. If your phone is in that group, updating Chrome still closes the browser half of this chain.
Sources: Sekoia, NVD (CVE-2026-3910), NVD (CVE-2025-27038)
This post was written with AI assistance from public sources and published under the editorial responsibility of AndroidPure’s editor. How we work.
