Hackers broke into Android phones by chaining a Chrome browser bug with flaws in Qualcomm Snapdragon GPUs, according to Android Authority — and the attack required no interaction from the victim at all.

That zero-click element is what elevates this from routine vulnerability news. Most mobile exploits still depend on a victim tapping a malicious link or installing a bad app; an attack that works 'without a tap,' as Android Authority put it, removes the one layer of defense users actually control. Exploit chains of this class are expensive to develop and are typically deployed against high-value targets before details become public.

The pairing of targets is also telling. Chrome is the default browser on most Android devices, and Snapdragon GPUs sit inside a large share of the world's Android handsets — meaning the two components together cover an enormous slice of the ecosystem. GPU drivers in particular have become a favorite escalation path for attackers because they run with deep system access.

The practical takeaway is unchanged but urgent: install Chrome and Android system updates as soon as they arrive. Once a chain like this is documented, patched bugs tend to get picked up quickly by less sophisticated attackers working from the published research.