External risk intelligence

ANGLE Sandbox Escape Vulnerability in Chrome for Android

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17676

The vulnerability requires an attacker to already have compromised the renderer process of a web browser on a specific mobile platform. This is a client-side sandbox escape scenario that is not typically exposed directly to the public internet as a service or network-facing endpoint.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in ANGLE, a graphics engine used in Google Chrome on Android, which could allow a remote attacker who has already compromised the browser's rendering process to escape the sandbox and potentially gain broader system access.

A browser vulnerability could allow system access.
Sandbox escapes are difficult but severe.
Confirm relevance; risk is likely low.

Attack Path

How an attacker could exploit the issue

An attacker who has already compromised the renderer process of Chrome on Android could leverage this vulnerability by presenting a specially crafted HTML page. This malicious page could then trigger a sandbox escape, allowing the attacker to break out of the browser's security boundary. The vulnerability resides in ANGLE, a component that translates graphics API calls.

Requires renderer process compromise.
Triggered by a crafted HTML page.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker who has already compromised the renderer process of Chrome on Android to escape the browser's sandbox. This could potentially lead to broader system access on the affected device.

Browser sandbox.
Crafted HTML page.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Android. Responsibility for addressing this likely falls to the platform or mobile application teams who manage Android devices and the Chrome browser instances running on them, as well as potentially the network and security teams to monitor for exploitation attempts. The first practical step is to identify all Android devices running Chrome, confirm their exposure and criticality, and then plan remediation, coordinating with any relevant vendor-management teams if direct patching is not feasible.

Platform and security teams own remediation.
Verify Chrome version and Android device inventory.
Plan targeted updates or controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome for Android?

ANGLE is a specialized graphics engine layer within Chrome. It translates high-level graphics commands from web content into formats that the underlying Android device hardware can execute. By acting as this bridge, it ensures that visual elements on websites render correctly across various mobile hardware configurations.

What does CVE-2026-17676 mean by a sandbox escape?

This vulnerability involves CWE-693, which relates to protection mechanism failures. A sandbox is a security boundary that isolates the browser's web content processes from the rest of your device's operating system. A sandbox escape means an attacker has found a way to break through that barrier, potentially allowing them to move beyond the browser and interact directly with the device's broader system.

How is this vulnerability triggered?

An attacker must first successfully compromise the browser's renderer process. Once that initial breach occurs, the attacker triggers the vulnerability by luring the user to a specially crafted HTML page. Simply browsing the web normally does not trigger this; it requires the renderer to be under an attacker's control before the malicious page can attempt the sandbox escape.

Why is the risk considered low according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability is not a typical network-facing service issue. Because it requires a multi-stage attack starting with a renderer compromise on a specific mobile platform, it is not directly exposed to the public internet as a standalone endpoint. It is highly specific to client-side browser execution, making widespread or opportunistic internet-based exploitation very unlikely.

What should I do if I manage Android devices?

Your first step is to inventory your Android fleet to identify devices running affected versions of Google Chrome. Confirm which devices are running versions older than 151.0.7922.72. Once identified, prioritize updating those Chrome instances to the patched version. Coordinate with your mobile device management teams to ensure these updates are pushed to devices that may not automatically receive the latest browser patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.