External risk intelligence

Chrome WebAuthn Sandbox Escape via Crafted PDF

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17990

The vulnerability resides within the browser's client-side processing of WebAuthn and PDF files. It requires a prior compromise of the renderer process and user interaction to trigger, making it a client-side execution issue rather than a service or appliance that is directly exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue in Google Chrome's WebAuthn feature could allow a remote attacker to escape the browser's sandbox by tricking a user into opening a specially crafted PDF file. This vulnerability is considered low severity by Chromium's internal assessment.

Input validation flaw in browser feature.
Low severity, requires prior compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by first compromising the browser's renderer process. With this access, they could then trick a user into opening a specially crafted PDF file, which would trigger the vulnerability. Successful exploitation could allow the attacker to escape the browser's sandbox.

Requires renderer process compromise.
Triggered by opening a crafted PDF.
Can lead to sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a sandbox escape could allow a compromised renderer process to gain elevated privileges. This could potentially affect system data or user data by enabling an attacker to bypass security boundaries within the browser.

System data could be affected.
A sandbox escape could occur.
Malicious code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome's WebAuthn implementation, specifically related to handling untrusted input within a compromised renderer process. Given that this is a client-side vulnerability requiring a prior renderer process compromise, platform and security teams should prioritize identifying affected endpoints, confirming business criticality, and engaging application owners for remediation planning. The initial focus should be on understanding the scope of exposure and confirming the actual risk to critical assets.

Identify affected endpoints and owners.
Verify user interaction and prior compromise.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and the WebAuthn feature?

Google Chrome is a widely used web browser that allows users to interact with internet content. WebAuthn, or Web Authentication, is a standard component within the browser that enables secure, passwordless logins using hardware keys or biometric data. This vulnerability affects how the browser processes incoming data through this specific authentication framework.

What does CWE-20 mean for CVE-2026-17990?

CWE-20, or Improper Input Validation, is the weakness class assigned to this issue. It means the software does not properly check or sanitize data received from an untrusted source before using it. In this case, the browser fails to validate input within its WebAuthn component, which is the technical flaw that enables the sandbox escape.

How is this sandbox escape triggered?

Triggering this bug requires two specific conditions: an attacker must first compromise the browser's renderer process and then successfully trick a user into opening a specially crafted PDF file. Simply visiting a malicious website or viewing a benign PDF file does not trigger the flaw.

Is my system at high risk for this vulnerability?

According to Halo Surface Signal, this is very unlikely. Because the issue requires a prior compromise of the renderer process and specific user interaction to trigger, it is a client-side execution issue rather than a service directly exposed to the public internet.

Do I need to update my browser immediately?

The first step for those running this technology is to ensure you are using Google Chrome version 151.0.7922.72 or later. Since the fix involves updating the software to resolve the input validation flaw, system administrators should identify endpoints running older versions and schedule the standard browser update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.