CVE-2026-17651 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical sandbox escape flaw in the Dawn graphics library component within Google Chrome for Android, affecting versions prior to 151.0.7922.72. The issue stems from inadequate validation of untrusted input within the Dawn rendering system which is responsible for handling graphics operations in web applications. When a malicious actor crafts a specially designed HTML page containing crafted graphics commands or data structures, the insufficient input validation allows arbitrary code execution outside the intended sandbox boundaries. The vulnerability specifically targets the graphics processing pipeline where unvalidated user-supplied data flows directly into graphics operations without proper sanitization or bounds checking.
The technical exploitation of this flaw leverages the Dawn graphics library's handling of potentially malicious input during WebGL or WebGPU operations, where graphics commands are processed and executed. This represents a classic sandbox escape vector through improper input validation, with the vulnerability classified under CWE-20 as "Improper Input Validation" and aligned with ATT&CK technique T1059.007 for "Command and Scripting Interpreter: JavaScript". The flaw enables attackers to bypass Chrome's security model by injecting malicious graphics commands that can manipulate memory or execute arbitrary code in the renderer process, potentially leading to full system compromise.
The operational impact of this vulnerability is severe given its critical severity rating and the broad attack surface it presents. Android users running vulnerable Chrome versions are at risk of remote code execution when visiting malicious websites, with no user interaction required beyond navigation to the compromised page. The sandbox escape capability means that an attacker could potentially access sensitive user data, install malware, or escalate privileges to system-level access. This vulnerability affects all Android users who rely on Chrome for web browsing and web application execution, making it particularly dangerous in environments where users may encounter untrusted content.
Mitigation strategies include immediate upgrade to Chrome version 151.0.7922.72 or later where the input validation has been strengthened to prevent malicious data from bypassing security boundaries. Organizations should implement network-level protections such as web application firewalls and content filtering systems that can detect and block malicious HTML content. Browser hardening measures including enabling sandboxing features, restricting graphics API access, and implementing strict Content Security Policies can provide additional defense layers. Users should avoid visiting untrusted websites and maintain regular software updates to ensure protection against known vulnerabilities. The fix implemented in the patched version addresses the core input validation issue by adding proper bounds checking and sanitization of graphics command data before processing, preventing malicious inputs from reaching the vulnerable graphics pipeline components.