External risk intelligence

Google Chrome for Android Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-14106

The vulnerability exists within the renderer process of a client-side web browser application. It requires a user to navigate to a specifically crafted HTML page to trigger the issue, making it a client-side execution risk rather than a service exposed directly to the public internet for remote connection.

Google Chrome

before 150.0.7871.47

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in Google Chrome on Android, concerning the insufficient validation of untrusted input within the Text component. While the Chromium security team has rated the severity as Low, the CVSS base score indicates a Critical vulnerability that could allow a remote attacker to escape the browser's sandbox through a crafted web page. The main concern at this time is confirming the relevance and exposure of this specific issue to our environment.

Input validation flaw in Chrome on Android.
Potential sandbox escape via crafted web page.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker would first need to compromise the renderer process of Google Chrome on Android. Once inside the renderer process, they could present a specially crafted HTML page to the user. Visiting this page could then allow the attacker to escape the browser's sandbox, potentially leading to broader system compromise.

Attacker must compromise renderer process first.
Triggered by visiting a crafted HTML page.
Allows sandbox escape, leading to wider compromise.

Live Threat

Current exploitation, exposure, and threat context

Insufficient validation of untrusted input in Google Chrome on Android, when a user visits a crafted HTML page, could allow a compromised renderer process to escape the sandbox. This may affect system data and service behavior.

System data and service behavior at risk.
Crafted HTML page could trigger exposure.
Sandbox escape may impact system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome on Android requires a user to interact with a malicious HTML page, suggesting that application owners and security teams are the primary stakeholders. The initial focus should be on identifying all Android devices running Chrome, assessing user exposure to potentially compromised websites, and coordinating with vendor management for browser updates.

Own by application and security teams.
Verify user exposure to malicious pages.
Coordinate browser update rollout.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome on Android?

Google Chrome on Android is a widely used mobile web browser that allows users to access internet content. It functions as a client-side application, meaning it operates locally on the user's mobile device to render websites. This browser uses a complex architecture, including a renderer process, to separate web content from the underlying device operating system for security.

What does CWE-20 mean for CVE-2026-14106?

CWE-20 refers to 'Improper Input Validation,' a common software weakness. In the context of CVE-2026-14106, this means the browser's Text component fails to properly verify or sanitize data provided from an untrusted source. Because the software accepts this input without sufficient checks, an attacker can manipulate the process to break out of the browser's security boundary, known as the sandbox.

How is this sandbox escape triggered?

An attacker must first compromise the browser's renderer process. Once that threshold is met, the attack proceeds when a user navigates to a specifically crafted HTML page. Simply having the browser installed or running in the background does not trigger this vulnerability; it requires active user interaction with malicious web content to initiate the escape sequence.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a client-side execution risk rather than a direct, internet-facing service vulnerability. Because the flaw exists within the browser's renderer process and requires user interaction with a specific page, it is unlikely to be triggered by remote scanning or background network activity. It is a local execution concern for individual mobile devices.

Do I need to take action to secure my environment?

Yes. While this is a client-side risk, you should identify all Android devices in your fleet running the affected Chrome versions. Coordinate with your vendor management teams to ensure these devices receive the latest browser updates from the manufacturer. Monitoring for updates is the primary method to mitigate the risk of sandbox escapes on your mobile assets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.