Attackers chain browser and chip flaws to breach mobile devices visiting spoofed websites

A cyber espionage campaign targeted iPhone and Android users by luring visitors to booby-trapped and hijacked websites, according to cybersecurity researchers. Security firm Sekoia revealed that the Android chain compromised phones running Google Chrome versions 139 to 145 without requiring victim interaction beyond visiting an infected webpage. Ars Technica reported that the hackers, assessed with moderate to high confidence as operatives from Russia's Foreign Intelligence Service, impersonated organizations including america250.org to deliver malicious JavaScript that attempted to steal browser cookies, saved logins, browsing history, Wi-Fi passwords, and full device data. [1][2]

On Android, the exploit chain operated in distinct stages specifically aimed at Qualcomm Snapdragon-powered devices. The assault first leveraged a Chrome vulnerability tracked as CVE-2026-3910 to execute code within the browser, followed by CVE-2025-27038—a flaw in Qualcomm's Adreno GPU driver—to escape Chrome's sandbox and gain deeper access to the operating system. Because the underlying vulnerabilities were previously patched, devices with current Chrome versions and up-to-date system security updates remained protected from the exploit. [1][2]