QUALCOMM FIXES THREE ADRENO GPU ZERO-DAYS EXPLOITED IN ATTACKS

Summary from the TLDR InfoSec newsletter

Qualcomm has patched three zero-day vulnerabilities in its Adreno GPU driver that are being actively exploited in targeted attacks. CVE-2025-21479 and CVE-2025-21480 cause memory corruption through unauthorized GPU command execution and CVE-2025-27038 is a use-after-free vulnerability in Chrome's graphics rendering. Google's Threat Analysis Group confirmed these vulnerabilities are under limited, targeted exploitation, and Qualcomm provided patches to device manufacturers in May with urgent deployment recommendations. This continues a pattern of Qualcomm chipset vulnerabilities being exploited by threat actors, including a previous zero-day used by Serbian authorities with Cellebrite software to unlock activists' and journalists' Android devices.