CVE-2026-14428: Google Chrome Dawn RCE Vulnerability

CVE-2026-14428 Overview

CVE-2026-14428 is an input validation vulnerability in the Dawn component of Google Chrome on Android. Dawn is Chromium's cross-platform implementation of the WebGPU standard. The flaw affects Chrome versions prior to 150.0.7871.46 and carries a Chromium security severity rating of High.

A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to attempt a sandbox escape. The weakness is classified as [CWE-20] Improper Input Validation.

Critical Impact
Successful exploitation allows an attacker to break out of the Chrome renderer sandbox on Android, extending initial renderer compromise into broader device access.

Affected Products

Google Chrome on Android prior to version 150.0.7871.46
Chromium-based browsers on Android incorporating the vulnerable Dawn/WebGPU component
Downstream Android browsers that ship the affected Chromium branch

Discovery Timeline

2026-07-01 - CVE-2026-14428 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14428

Vulnerability Analysis

The vulnerability resides in Dawn, the Chromium subsystem that implements WebGPU and mediates GPU work submitted by web content. Insufficient validation of untrusted input allows crafted GPU commands or resource descriptors to reach lower-privilege boundaries with unsafe state.

An attacker must first control the renderer process on the target Android device. From that foothold, malicious inputs delivered through a crafted HTML page are routed to the Dawn/GPU process, where the missing validation opens a path to escape the renderer sandbox.

Exploitation requires user interaction, such as visiting a hostile page, and the attack complexity is elevated because the adversary must chain this bug with a prior renderer compromise. The scope changes on exploitation, meaning impact extends beyond the initially vulnerable component.

Root Cause

The root cause is improper validation of untrusted input crossing the renderer-to-GPU IPC boundary within Dawn. Data supplied by the compromised renderer is trusted more than it should be, letting the attacker manipulate GPU-side state or memory in ways the sandbox model does not anticipate. See Chromium Issue Tracker #520180257 for the tracked defect.

Attack Vector

The attack is delivered over the network through a crafted HTML page rendered by Chrome on Android. Exploitation is a multi-stage chain: the attacker first exploits a separate flaw to compromise the renderer, then uses this Dawn issue to escape the sandbox. Refer to the Google Chrome Stable Update for release context.

No public proof-of-concept code has been released for CVE-2026-14428. The vulnerability is described in prose only because no verified exploit or patch code is publicly available.

Detection Methods for CVE-2026-14428

Indicators of Compromise

Android devices running Chrome versions earlier than 150.0.7871.46 that have loaded untrusted web content
Unexpected crashes or restarts of the Chrome GPU process on Android tied to WebGPU workloads
Renderer processes spawning or communicating with unexpected child processes after visiting external sites

Detection Strategies

Inventory Chrome for Android build versions across managed mobile fleets and flag any host below 150.0.7871.46
Correlate mobile browser telemetry with proxy or DNS logs to identify sessions loading suspicious WebGPU-heavy content
Monitor Android crash reports and ANR (Application Not Responding) events for repeated Chrome GPU process failures

Monitoring Recommendations

Enable mobile threat defense telemetry on managed Android endpoints to capture browser process anomalies
Track outbound connections from mobile devices to newly registered or low-reputation domains serving active web content
Review MDM (Mobile Device Management) compliance reports for Chrome update lag across the fleet

How to Mitigate CVE-2026-14428

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.46 or later through the Google Play Store
Push forced updates via MDM policy for enterprise-managed Android devices
Restrict access to untrusted or high-risk web content on devices that cannot be updated promptly

Patch Information

Google has addressed CVE-2026-14428 in Chrome 150.0.7871.46 and later on Android. Details are available in the Google Chrome Stable Update release notes and the associated Chromium Issue Tracker #520180257.

Workarounds

Avoid browsing untrusted sites on unpatched Chrome for Android installations until the update is applied
Use enterprise browser policies to disable or restrict experimental WebGPU features where operationally feasible
Enforce Play Store auto-update policies so security releases install without user intervention

bash

# Verify Chrome for Android version via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 150.0.7871.46 or later
# versionName=150.0.7871.46