WORLDTECHChrome bug and Qualcomm GPU flaw chained to infect Android phones
A security firm reports that attackers combined a Chrome bug with a flaw in the Qualcomm Adreno GPU driver to compromise Android phones that opened a rigged website. Both weaknesses had already been fixed, so handsets running up-to-date Chrome and security updates were not at risk.
How the Android infection worked
Security researchers at Sekoia have described a mobile hacking campaign that targeted Android and iPhone users through hijacked and fake websites. On Android, the intruders needed nothing from the victim: no tapped link, no installed app and no granted permission.
The intrusion rested on two separate weaknesses. One was a Chrome bug that allowed hackers to break into Android phones without any tap. The other was a driver flaw in the Qualcomm Adreno GPU, a chip built to run many calculations at once and used for graphics and AI work.
Fixes for both flaws already released
Both flaws had been patched before the report appeared, so the makers had already issued corrections. Phones with current Chrome and up-to-date security updates were therefore unaffected.
Google, which develops Chrome, and Qualcomm, whose Snapdragon platform includes the Adreno GPU, are responsible for the software and chip components involved.
Open questions
- How many Android phones were infected before the flaws were patched?
- Which Chrome and Adreno driver versions were affected?