Qualcomm Fixes 3 Zero-Days in Adreno GPU: Legal Remedies and Reporting for Android Cyber Attacks in India

Introduction: Qualcomm's Adreno GPU Vulnerabilities

Qualcomm recently released critical security fixes addressing three high-severity zero-day vulnerabilities actively exploited in targeted attacks against Android devices. These flaws, situated within the Adreno GPU and display driver components, allowed threat actors to achieve unauthorized privilege escalation and execute malicious code beneath the standard Android security architecture.

Unlike traditional malware delivered via suspicious APK files, hardware and driver-level exploits—such as those targeting GPU sub-architectures—can compromise a device silently. For professionals, corporate leaders, and individuals across Mumbai, Thane, and Mira Road who rely on Android smartphones for corporate communications, banking, and confidential data storage, this development highlights the evolving nature of digital surveillance and cyber intrusion.

In this explainer, we analyze the technical reality of the threat, examine the legal remedies available under the Information Technology (IT) Act, 2000 and the Bharatiya Nyaya Sanhita (BNS), 2023, evaluate evidence preservation under the Bharatiya Sakshya Adhiniyam (BSA), 2023, and provide a clear roadmap for reporting cyber intrusions in the Mumbai Metropolitan Region.

---

Understanding the Threat: How Adreno GPU Zero-Days Work

A zero-day vulnerability refers to a security flaw known to attackers before the vendor develops and distributes a patch. The vulnerabilities discovered in Qualcomm's Adreno GPU drivers involve memory corruption weaknesses (such as use-after-free or buffer overflow issues). When exploited:

1. Privilege Escalation: An attacker with limited initial access can elevate privileges to kernel or root levels.
2. Bypassing the Android Sandbox: Android normally restricts apps to isolated environments (sandboxes). A driver-level exploit breaks this isolation, granting access to private application storage, encrypted chats, SMS messages, and microphones.
3. Targeted Spyware Deployment: Historically, zero-days of this sophistication are deployed by commercial surveillance vendors or state-aligned threat actors targeting specific individuals—such as business executives, legal practitioners, civil society members, or government officials—often via zero-click or single-click delivery mechanisms.

While Qualcomm has issued updates to device manufacturers (OEMs), users must install the latest security updates pushed by their respective smartphone brands (e.g., Samsung, OnePlus, Xiaomi) to secure their devices.

---

Indian Legal Framework: Criminal Penalties and Civil Liabilities

When a smartphone is targeted or compromised by unauthorized intrusions in India, multiple legal provisions under both specialized cyber legislation and general criminal statutes are activated.

1. The Information Technology Act, 2000 (IT Act)

• Section 43 read with Section 66: Section 43 prescribes civil liability and compensation for accessing, downloading, introducing contaminants (malware), or damaging computer systems without owner permission. When committed dishonestly or fraudulently, Section 66 makes this a criminal offense punishable by imprisonment of up to three years, a fine of up to ₹5 lakh, or both.
• Section 66E (Violation of Privacy): If the zero-day exploit is utilized to capture, transmit, or publish private images or personal moments without consent.
• Section 43A and Data Protection Liabilities: Corporate entities handling sensitive personal data on enterprise devices that fail to implement reasonable security procedures face financial claims for damages under Section 43A, alongside emerging responsibilities under the Digital Personal Data Protection (DPDP) Act, 2023.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

The Bharatiya Nyaya Sanhita, 2023, which replaced the Indian Penal Code (IPC), covers consequential offenses arising from cyber intrusion:

• Section 318 & 319 (Cheating and Impersonation): If compromised access is used to defraud financial institutions or impersonate the device owner.
• Section 308 (Extortion): If the exploit results in corporate espionage, ransomware deployment, or data blackmail.
• Section 61 (Criminal Conspiracy): Applicable to syndicates or individuals conspiring to execute targeted intrusions.

3. Evidentiary Standards under Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (which supersedes the legacy Section 65B of the Indian Evidence Act), electronic records—including device system logs, memory dumps, network capture files, and forensic extraction reports—must be accompanied by an electronic certificate validating that the device operated properly and that the data was not tampered with. Securing forensically sound evidence before wiping or factory-resetting an infected device is legally crucial.

---

Practical Steps: How Victims in Mumbai, Thane, and Mira Road Can Act

If you detect anomalous behavior—such as unexplainable battery drain, unauthorized background data spikes, abnormal application crashes, or unauthorized access to communication apps—take the following immediate steps:

Step 1: Technical Isolation (Do Not Wipe Immediately)

• Disconnect the device from Wi-Fi and mobile networks (enable Airplane Mode).
• Avoid performing a factory reset immediately if you intend to seek legal or criminal prosecution, as doing so destroys forensically vital volatile memory and log trails.

Step 2: Formal Reporting to CERT-In

Under the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013, cybersecurity incidents such as targeted intrusions and system compromises must be reported to the Indian Computer Emergency Response Team (CERT-In) via incident@cert-in.org.in.

Step 3: Registering a Complaint in the Mumbai Metropolitan Region

Victims in the Mumbai area can register criminal complaints through physical and digital channels:

1. National Cyber Crime Reporting Portal: Lodge an initial complaint at cybercrime.gov.in or call the national cyber helpline at 1930.
2. Mumbai Cyber Police Stations: Depending on your jurisdiction:
   • Cyber Police Station, Bandra-Kurla Complex (BKC): Deals with high-level corporate cyber fraud, targeted hacking, and cross-border digital intrusions.
   • Regional Cyber Police Stations: Located across North (Kandivali), South (Colaba/Worli), Central, and East divisions.
3. Thane & Mira-Bhayandar Jurisdictions:
   • Thane City Cyber Crime Police Station: Located near the Police Commissionerate, Thane (West).
   • Mira-Bhayandar-Vasai-Virar (MBVV) Cyber Police Station: Handles offenses originating within Mira Road and adjacent areas.

Step 4: Pursuing Civil Adjudication for Damages

Beyond filing an FIR, corporate victims or individuals suffering quantifiable financial loss can file an application for damages before the Adjudicating Officer (IT Act)—typically the Principal Secretary (IT) of the Government of Maharashtra, located at Mantralaya, Mumbai. Under Section 46 of the IT Act, this authority possesses the powers of a civil court to award compensation up to ₹5 crore.

---

Frequently Asked Questions (FAQs)

1. Does installing an antivirus app protect against Qualcomm Adreno zero-days?

Standard commercial antivirus applications operate within user-space permissions on Android and frequently fail to detect zero-day vulnerabilities residing in GPU firmware or kernel drivers. The only reliable mitigation is applying official Android security patch updates released by your device manufacturer.

2. Can I claim compensation if my corporate confidential data was stolen via a mobile zero-day?

Yes. Under Section 43 of the IT Act, a victim can seek damages from the perpetrator. If the breach involved third-party service providers or employers failing to maintain reasonable security safeguards, remedies can also be pursued under Section 43A of the IT Act or applicable consumer and civil contractual laws.

3. How do I preserve digital evidence from a hacked Android phone for court?

Do not delete apps or format the device. Engage an accredited digital forensics professional or submit the device directly to the investigating officer at the Cyber Police Station. To ensure admissibility in court under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, a strict chain of custody and a technical certificate must accompany the extraction.

4. What is the difference between filing an FIR and an Adjudication Application under the IT Act?

An FIR initiated under Section 66 of the IT Act and the Bharatiya Nyaya Sanhita (BNS) triggers a criminal investigation aimed at identifying, arresting, and prosecuting the offender. An Adjudication Application before the IT Adjudicating Officer (Secretary, IT Department) is a quasi-judicial proceeding aimed at obtaining monetary compensation for the victim.

---

Conclusion & Legal Assistance

Hardware-level vulnerabilities like Qualcomm's Adreno zero-days demonstrate that cyber threats are no longer restricted to simple phishing links. When high-value devices and executive communications are breached, responding rapidly with both technical containment and targeted legal measures is essential to limit liability and preserve corporate integrity.

If your organization or personal device has been compromised, or if you need assistance preparing cyber incident reports, navigating proceedings before the Adjudicating Officer, or securing digital evidence under the new criminal codes, APS Law is available to assist. Reach out to our offices in Mumbai, Thane, or Mira Road to request a legal consultation.