Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 2, 2025 · Catalog

   Detected

   Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

2. Jun 3, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Jun 24, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Affected

• cpe qualcomm/ar8031 firmwareversion unspecified
• cpe qualcomm/csra6620 firmwareversion unspecified
• cpe qualcomm/csra6640 firmwareversion unspecified
• cpe qualcomm/fastconnect 7800 firmwareversion unspecified
• cpe qualcomm/qca2066 firmwareversion unspecified
• cpe qualcomm/qca6391 firmwareversion unspecified
• cpe qualcomm/qcm6125 firmwareversion unspecified
• cpe qualcomm/qcm8550 firmwareversion unspecified
• cpe qualcomm/qcn9011 firmwareversion unspecified
• cpe qualcomm/qcn9012 firmwareversion unspecified
• cpe qualcomm/qcs6125 firmwareversion unspecified
• cpe qualcomm/qcs8550 firmwareversion unspecified
• vendor Qualcomm Multiple Chipsetsversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2025-27038

  Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

  cisa.gov
• CVE.orgVulnerability recordCVE-2025-27038

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-27038

  30-day exploitation probability 1.0%

  first.org
• NIST NVDVulnerability recordCVE-2025-27038

  Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

  nvd.nist.gov

References

• CISA note · docs.qualcomm.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov