CVE-2026-17651

Analyzed Analyzed - Analysis Complete

Insufficient Input Validation in Chrome Dawn on Android Leads to Sandbox Escape

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17651

EUVD

EUVD-2026-50777

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient validation of untrusted input in Dawn in Google Chrome on Android. It allows a remote attacker to potentially escape the sandbox via a crafted HTML page, which could lead to unauthorized access or code execution outside the app's restricted environment.

Detection Guidance

This vulnerability involves insufficient validation in Google Chrome on Android, allowing sandbox escape via crafted HTML. Detection requires checking Chrome version on Android devices. Run: adb shell dumpsys package com.android.chrome | grep versionName. If version is below 151.0.7922.72, the device is vulnerable.

Impact Analysis

This vulnerability could allow attackers to run malicious code on your device by exploiting a flaw in Chrome's sandbox. If exploited, it may compromise your data, install malware, or perform actions without your permission.

Compliance Impact

This vulnerability involves insufficient validation of untrusted input in Google Chrome on Android, potentially allowing sandbox escape via crafted HTML. Such issues could lead to unauthorized data access or exfiltration, which may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Google Chrome on Android to version 151.0.7922.72 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-17651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70