External risk intelligence

Chrome for Android Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17713

This vulnerability requires a renderer process compromise and user interaction via a crafted HTML page within the browser. As a client-side browser component issue, it does not represent an internet-facing service, gateway, or network-accessible management interface that is directly reachable from the public internet in standard deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Android's Chrome browser, allowing a compromised attacker to potentially escape the browser's security sandbox through a specially crafted webpage. This could enable attackers to gain elevated privileges on the affected device.

Malicious webpages can break browser security.
Confirms exposure and relevance to our Android users.
Assess potential impact on Android device users.

Attack Path

How an attacker could exploit the issue

An attacker who has already compromised the renderer process within Chrome on Android could lure a user to a malicious website. This website, containing a crafted HTML page, could then trigger a vulnerability in Chrome's accessibility features, potentially allowing the attacker to escape the browser's sandbox.

Requires renderer process compromise.
Triggered by visiting a malicious page.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker who has already compromised the renderer process to escape the sandbox when interacting with a specially crafted HTML page. This could affect system data and service behavior under specific conditions, although the advisory does not detail the exact types of data or information that could be exposed.

System data and service behavior at risk.
Sandbox escape via crafted HTML page.
Potential for unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this vulnerability in Chrome on Android, primary ownership likely resides with teams managing the mobile application ecosystem or platform owners responsible for the Android operating system, in coordination with the security team. The immediate first step is to identify all Android devices running Chrome, assess their exposure, and confirm business criticality. Planning for remediation should then be based on risk, potentially involving vendor coordination or staged updates.

Mobile app or platform owners should lead.
Verify Chrome on Android deployment scope.
Plan risk-based remediation and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome on Android?

It is the mobile version of the Google Chrome web browser built for the Android operating system. It provides essential web browsing capabilities and includes specialized accessibility features designed to help users interact with web content. These features are tightly integrated into the browser architecture to ensure users can navigate complex pages, which is where this vulnerability specifically resides.

What does CWE-20 mean for CVE-2026-17713?

CWE-20, or Improper Input Validation, describes a failure to safely check data before the system processes it. In this case, Chrome’s accessibility features do not properly verify data provided from an untrusted source. This weakness allows a malicious process to send unexpected or malformed information that tricks the browser into executing unintended actions, ultimately leading to a bypass of the browser's security controls.

How does an attacker trigger this vulnerability?

An attacker must first successfully compromise the browser's renderer process. Once that occurs, they must lure a user to a specially crafted HTML page. Simply having the browser installed or running in the background is not enough; the vulnerability does not trigger unless the user actively interacts with the malicious webpage content within the browser.

Is CVE-2026-17713 internet-facing?

According to Halo Surface Signal, this is not an internet-facing service or management interface. It is a client-side browser component issue that requires specific conditions, such as user interaction and a prior renderer compromise. Because it exists within the application layer rather than as a public-facing network gateway, its risk profile is distinct from standard server-side vulnerabilities.

What should I do if I use Chrome on Android?

The immediate priority is to verify your current Chrome version and ensure it is updated to 151.0.7922.72 or later. Since this vulnerability affects the browser software itself, users should check their application settings or app store for available updates. Organizations should inventory their Android devices and prioritize the deployment of these security updates to close the identified gap in the browser's sandbox.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.