External risk intelligence

Chrome for Android Dawn Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17651

The vulnerability requires a user to interact with a crafted HTML page within a specific web browser on Android. Because it is a client-side execution issue dependent on user interaction with untrusted web content rather than an internet-facing service, gateway, or exposed management interface, it lacks the characteristics of a directly reachable public-facing attack surface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Google Chrome on Android that could allow attackers to escape the browser's security sandbox. This issue arises from insufficient validation of untrusted input within the Dawn component, meaning a user interacting with a malicious HTML page could be at risk. The potential impact involves significant compromise of data and system integrity.

Malicious websites can escape Chrome's security.
Critical risk of data compromise and system impact.
Confirm relevance and assess exposure to user actions.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page, which then exploits a flaw in how Google Chrome on Android handles untrusted input. This could allow the attacker to break out of the browser's security sandbox.

Requires visiting a malicious page.
Vulnerable input validation in Chrome.
Potential sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Google Chrome on Android, when triggered by a user visiting a malicious HTML page, could allow an attacker to escape the browser's sandbox. This could potentially affect the system data and service behavior of the Android device.

Sensitive system data could be accessed.
Malicious HTML page interaction.
Potential for unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Android. Ownership typically lies with the platform or device management team responsible for managing mobile application deployments and their security. The first practical step is to determine the scope of affected devices and users, assess the business criticality of their mobile operations, and then coordinate with Chrome release management for updates or vendor engagement if direct patching is not feasible.

Platform and device owners should take ownership.
Verify Chrome version and user exposure.
Plan targeted updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dawn component in Google Chrome on Android?

Dawn is a foundational library within the Chromium project used to implement modern web graphics APIs like WebGPU. It acts as a bridge between web content and the device's hardware, allowing browsers to perform complex rendering tasks. In this context, it processes instructions from websites to display graphics.

How does CVE-2026-17651 enable a sandbox escape?

This vulnerability stems from improper input validation, classified as CWE-20. The browser's sandbox is a security boundary meant to isolate web content from your device's core operating system. Because Dawn fails to properly vet incoming data, a specially crafted webpage can bypass these restrictions, potentially allowing the site to execute unauthorized code outside the browser's intended environment.

Do I need to be logged into a site for this to trigger?

No, user authentication is not required. The attack is triggered simply by visiting a malicious webpage using an affected version of Chrome on Android. The bug does not trigger through background network traffic or service communication; it requires the specific action of a user navigating to a webpage designed to exploit the Dawn component's input handling.

Is my device at risk if it only accesses internal networks?

According to Halo Surface Signal, this vulnerability is considered unlikely to affect internal-only infrastructure because it is a client-side issue. The risk depends on users navigating to malicious content, not on whether the device is internet-facing or inside a private network. If a user on an internal network visits a malicious page, the risk remains.

How should I respond to this Chrome vulnerability?

The primary defense is ensuring your mobile browsers are updated to version 151.0.7922.72 or later. If you manage mobile devices, identify which assets are running older, vulnerable versions of Chrome. Prioritize updating these endpoints to apply the vendor's security fixes, which restore proper input validation within the Dawn component and seal the sandbox escape path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.