External risk intelligence

Chrome for Android Dawn Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-13934

This vulnerability requires a remote attacker to have already compromised the renderer process, combined with user interaction via a crafted HTML page to trigger the issue. It is a client-side browser-based flaw that is not directly exposed as an internet-facing service, gateway, or management surface.

Google Chrome

before 150.0.7871.47

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in Google Chrome on Android could allow an attacker to escape the browser's security sandbox. This means a compromised web page could potentially gain greater access to the device than intended, impacting user data and system integrity. The primary concern is confirming if our organization's Android Chrome usage is exposed to this risk.

Flaw allows attackers to break out of Chrome's security.
Matters if users browse untrusted web pages.
Confirm Chrome relevance and any exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker who has already compromised the renderer process can trick a user into visiting a malicious webpage. This action allows the attacker to potentially break out of the browser's sandbox, gaining broader access to the system.

Compromised renderer process is required.
Triggered by a crafted HTML page.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page when supported by the advisory. This could allow the attacker to execute code at the user's full privilege level on the host operating system.

Data or system assets at risk.
Attacker could escape the browser sandbox.
Malicious code execution on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Android, specifically concerning a sandbox escape via a crafted HTML page. In a real-world scenario, the Google Chrome product owner or the platform team responsible for managing browser deployments would likely lead the response. The initial practical step involves identifying all Android devices running Chrome, confirming if these devices are business-critical or could be exposed, and then coordinating with relevant teams to plan remediation.

Own the issue: Chrome product/platform owners.
Verify first: Chrome deployment reachability.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dawn in the context of Google Chrome?

Dawn is an open-source component within Google Chrome that serves as the interface between web applications and the device's graphics hardware. It enables web content to perform complex rendering tasks, such as 3D graphics, by acting as a bridge to underlying APIs like Vulkan or OpenGL. This component is essential for modern web experiences, but it also sits at a critical intersection between the browser's isolated sandbox and the underlying operating system resources.

What does this sandbox escape vulnerability mean?

This vulnerability involves Improper Input Validation (CWE-20). In browser security, the 'sandbox' is a containment layer that prevents websites from accessing your device's files or system data. Because the Dawn component fails to properly validate certain data, an attacker can bypass these safety barriers. This essentially allows a malicious webpage to 'break out' of its restricted container to potentially read, modify, or execute code on the host device.

How is this vulnerability triggered by an attacker?

The attack path requires a two-step sequence. First, the attacker must have already gained control over the browser's renderer process. Second, they must lure a user into loading a specifically crafted HTML page. Simply browsing the web does not trigger this flaw unless the user visits a site designed to exploit this specific gap. It does not occur if the renderer remains secure or if the user avoids interacting with malicious content.

Is my device vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that this is a client-side browser issue rather than an internet-facing service or server-side gateway. Because it requires a specific sequence of prior compromise and user interaction to trigger, it is classified as very unlikely to be directly exposed as a management surface. You should focus on devices where users frequently navigate to untrusted or potentially malicious websites.

How should I respond to CVE-2026-13934?

If you are responsible for managing Android devices in your organization, the first step is to perform an inventory of all devices running versions of Google Chrome earlier than 150.0.7871.47. Confirm which devices are business-critical and prioritize them for updates. Work with your platform or mobile device management teams to ensure the latest browser version is deployed, as this update contains the necessary security patches to close the input validation gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.