Qualcomm has urgently addressed three security flaws in its Adreno GPU drivers after discovering they had already been leveraged in limited, targeted attacks. The vulnerabilities, which are tracked as CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038, were reported by Google’s Android Security and Threat Analysis teams. All three could potentially allow unauthorized access or memory corruption if exploited.
Two of the flaws involve incorrect authorization in the graphics component and carry a high-severity score, while the third centers on a use-after-free flaw in the way graphics are rendered with Adreno GPUs. Although Qualcomm has now released patches, the company emphasized that the vulnerabilities had been actively targeted before fixes became available.
So far, Qualcomm has not shared specifics about who used the flaws or what techniques they relied on. Still, previous vulnerabilities affecting Qualcomm chipsets have been taken advantage of by commercial spyware vendors. Google’s Pixel phones, which use Tensor chips, are not affected by these Adreno driver issues. However, users with affected devices will need to wait for their device makers to roll out software updates, a process that often takes time.
Qualcomm has urged OEMs to prioritize these patches and enable updates as soon as possible to protect users. For now, those with vulnerable devices should be diligent about installing forthcoming updates and keeping their systems current. This incident highlights the ongoing need for rapid patching of mobile device vulnerabilities, especially when threat actors are already exploiting them.
