A watering-hole campaign attributed to the Russian state-linked group APT29 used two known vulnerabilities — one in Google Chrome and one in Qualcomm’s Adreno GPU driver — to break into Android phones and steal browser cookies, saved logins, browsing history and saved Wi-Fi passwords, according to a report by security firm Sekoia. The attacks ran through compromised legitimate websites, which means victims did not have to install anything or click a suspicious download: visiting the wrong page with an unpatched phone was enough.
The important context, stated up front: these are not new zero-day discoveries. Both flaws are tracked, catalogued vulnerabilities, and the campaign depended on devices that had not applied the fixes available for them. The practical lesson is unglamorous but real — update Chrome and your phone’s software. Here is what Sekoia found, and how to check your own device.
Key Takeaways
- Sekoia attributes the campaign to APT29 (linked to Russia’s SVR intelligence service, moderate-to-high confidence), targeting users in the US and Europe with a heavy focus on Ukraine.
- The Android exploit chained CVE-2026-3910 (code execution inside Chrome) with CVE-2025-27038 (a Qualcomm Adreno GPU driver flaw) to escape Chrome’s sandbox.
- It targeted Chrome versions 139 to 145 (version 143 excluded) on Snapdragon-powered phones, and deployed malware Sekoia calls AndroSnitch.
- Stolen cookies can hijack signed-in sessions — so the damage goes beyond passwords to accounts you were already logged into.
- Victims were reached through compromised real websites, a hijacked Ukrainian web analytics service, and fake sites (including a copy of the America250 site and a fake London luxury hotel).
How the Attack Worked
The delivery method is what security people call a watering hole: instead of attacking victims directly, the group poisoned places victims already visit. Sekoia’s investigation began with a malicious JavaScript inclusion on the website of a Ukrainian gas production company, and found the attackers had also compromised a Ukrainian web analytics service used by thousands of websites (exploited between August 27 and September 3), plus lookalike sites impersonating real ones.
On Android, the chain had two steps:
- CVE-2026-3910 let the malicious page run code inside Google Chrome itself.
- CVE-2025-27038, in the Adreno GPU driver used across Snapdragon chipsets, let the code escape Chrome’s sandbox and reach the device beyond the browser.
Once inside, the AndroSnitch malware collected Chrome cookies, saved login details and browsing history, and read Wi-Fi configuration files containing saved network passwords. Cookies are the sleeper danger here: with a stolen session cookie, an attacker can walk into an account as you, bypassing the password entirely. One curious detail — the exploit reportedly stopped itself if it detected a Samsung Galaxy S25 Ultra, a reminder that these campaigns pick their targets deliberately.
iPhone users were targeted through separate chains (including one aimed at iOS 16–17.4 cookies and the DarkSword exploit against iOS 18.5), but the Android chain is the one tied to the Chrome and Qualcomm flaws.
Why “Known Flaws” Is the Whole Story
It would be easy to read this as “Android is hacked” — it is not. APT29 is a top-tier state actor, and even it was working with previously disclosed vulnerabilities, because that is what works at scale: the gap between a fix existing and people installing it. The campaign specifically hunted Chrome builds several versions behind (139–145) — current Chrome has moved past them.
That cuts both ways. If your Chrome and your phone are current, this particular chain has nothing to grab onto. If you have been dismissing update prompts for months, this report is what those prompts were about. State groups, commercial spyware vendors and ordinary criminals all shop from the same shelf of unpatched flaws — a theme that also ran through the November Android security bulletin, whose most severe bug needed no user interaction at all.
How to Protect Your Phone (5 Minutes)
- Update Chrome now. Open the Play Store → your profile → Manage apps → Updates, and update Chrome (or open Chrome → ⋮ → Settings → About Chrome, which shows the version). Do not stay on versions in the 130s–140s.
- Install the latest Android security update. Settings → Security & privacy → Updates (wording varies) — or check your patch level against our guide to the November 2026 security update.
- Treat saved passwords as exposed if you were ever careless with updates. Change the important ones (email first — it resets everything else) and turn on two-step verification where it is offered.
- Review signed-in sessions on your Google account (myaccount.google.com → Security → Your devices) and sign out anything you do not recognise — this is the direct antidote to stolen cookies.
- Be suspicious of “the site looks normal” logic. This campaign lived on real websites. Updates, not eyeballs, are the defence.
The Bottom Line
Sekoia’s report is a spy story — state hackers, a poisoned analytics service, fake patriotic websites — built on a mundane foundation: phones that had not been updated. The Chrome and Qualcomm flaws in the chain are known and fixable, and the attackers knew most people would not have bothered. Five minutes in your update settings is the entire difference between being in this campaign’s target set and being a dead end for it.
Related Guides
- Android November 2026 Security Update: Critical RCE Flaw Fixed
- Android ‘SMS of Death’ Bug: What It Is and How the Fix Works
- Samsung November 2026 Security Update: Over 160 Flaws Fixed
FAQs
What did the APT29 campaign steal from Android phones?
According to Sekoia, the AndroSnitch malware collected Chrome cookies, saved login information and browsing history, and accessed Wi-Fi configuration files containing saved network passwords. Stolen cookies can also let attackers enter accounts where the user was already signed in.
Which flaws and versions were involved?
The chain used CVE-2026-3910 in Google Chrome and CVE-2025-27038 in Qualcomm’s Adreno GPU driver to escape Chrome’s sandbox. It targeted Chrome versions 139 through 145 (excluding 143) on Snapdragon-powered Android devices.
Is my phone at risk right now?
The campaign relied on known vulnerabilities on unpatched devices. If your Chrome is up to date and your phone runs a recent Android security patch level, this specific chain should not work on your device. Keeping the browser and system updated is the protection Sekoia recommends.
How were victims infected if they installed nothing?
Through watering-hole attacks: legitimate websites were compromised (and a web analytics service used by thousands of sites was hijacked), so simply visiting an affected page with a vulnerable browser could start the exploit — no download or install was needed.
