External risk intelligence

Google Chrome Device Trust Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-14055

This vulnerability requires a remote attacker to have already compromised the browser's renderer process and specifically targets a sandbox escape within the client-side browser application. It is not an internet-facing service or protocol that can be reached directly from the network.

Google Chrome

before 150.0.7871.47

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome on Windows could allow a sophisticated attacker to escape the browser's security sandbox. This exploit requires the attacker to have already compromised the renderer process of the browser and is considered low severity by the Chromium security team. The main concern is to confirm whether our environment is affected and understand the potential exposure.

Unpatched Chrome might allow deeper system access.
Confirms a technical risk to browser security.
Verify relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could start by compromising the browser's renderer process. With this access, they could then present a specially crafted HTML page to the user. This page would interact with a feature in Chrome that has insufficient validation of untrusted input, potentially allowing the attacker to break out of the browser's security sandbox.

Requires renderer process compromise.
Triggered by a malicious HTML page.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker who has already compromised the browser's renderer process to escape the sandbox. This may lead to the execution of arbitrary code on the user's system when a user visits a malicious, specially crafted HTML page.

User's system.
Compromised renderer process and malicious page.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Windows. Technical leaders and security teams should coordinate with application owners and infrastructure teams to identify deployments, assess business criticality and reachability, and plan remediation.

Own the issue: Application owners.
Verify first: Affected deployments and reachability.
Action to follow: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Device Trust feature?

Device Trust is a component within the Google Chrome browser ecosystem on Windows designed to verify the security state and identity of a device. It manages sensitive operations that require interactions between the browser's isolated security environments and the underlying Windows operating system. Because it handles authentication and trust signals, it is a critical gatekeeper for secure access.

What does CWE-20 mean for CVE-2026-14055?

CWE-20 refers to 'Improper Input Validation.' In the context of CVE-2026-14055, this means the Device Trust component does not sufficiently verify the data it receives from untrusted sources. Because the system trusts this incoming information without proper checks, it creates a logic flaw that an attacker can manipulate to bypass security constraints, such as the browser's sandbox.

How does an attacker trigger this vulnerability?

An attacker must first successfully compromise the browser's renderer process to initiate the attack. Once inside that process, they must induce the user to visit a specially crafted HTML page. Simply navigating to a typical, non-malicious website does not trigger this flaw. The attack requires both the prior compromise and specific, malicious interaction with the vulnerable Device Trust component.

Do I need to worry about this if I am not internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to be reached via the network because it is not an internet-facing service or protocol. It relies on a multi-stage attack where the browser process is already compromised. While local system security remains a priority, the nature of this sandbox escape makes it a client-side concern rather than a direct network-based exposure for your infrastructure.

When should I update Google Chrome?

You should plan to update to version 150.0.7871.47 or later as part of your standard maintenance lifecycle. Since this vulnerability requires a prior compromise of the renderer process, prioritize patching systems where users frequently interact with untrusted content. Coordinate with your application owners to identify affected Windows deployments and ensure they receive the update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.