CVE-2026-17651 Overview
CVE-2026-17651 affects Dawn, the WebGPU implementation in Google Chrome on Android. Insufficient validation of untrusted input allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Google rated the underlying Chromium security severity as Critical. The issue is fixed in Chrome for Android version 151.0.7922.72. The weakness is classified under CWE-20: Improper Input Validation. Any Android user browsing an attacker-controlled page with a vulnerable Chrome build could be exposed. A sandbox escape breaks the primary boundary that isolates web content from the underlying operating system.
Critical Impact
A remote attacker can escape the Chrome renderer sandbox on Android through a malicious HTML page, potentially enabling code execution outside the browser's isolation boundary.
Affected Products
- Google Chrome on Android prior to 151.0.7922.72
- Dawn component (WebGPU implementation) shipped inside Chrome
- Chromium-based browsers on Android that embed the vulnerable Dawn revision
Discovery Timeline
- 2026-07-30 - CVE-2026-17651 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17651
Vulnerability Analysis
Dawn is the cross-platform implementation of the WebGPU standard used by Chromium. It exposes GPU functionality to web content through a strictly defined API surface. CVE-2026-17651 stems from insufficient validation of untrusted input reaching Dawn from a web page. When the malformed input is processed, the renderer performs operations outside the constraints the sandbox assumes to be enforced. This creates the conditions for a sandbox escape, moving attacker-controlled execution from the renderer process toward the broader Android environment. Google's Chromium team assigned the underlying issue a Critical severity, which the project reserves for sandbox escapes and comparable memory-safety breaks.
Root Cause
The root cause is improper input validation ([CWE-20]) within Dawn. Parameters or command streams supplied by web content are accepted without adequate bounds or type checks before being passed to lower-level GPU handling code. Because Dawn straddles the renderer sandbox boundary and privileged GPU interfaces, missing validation at this layer can be leveraged to influence memory or state outside the sandboxed context.
Attack Vector
Exploitation requires a user to load a crafted HTML page in a vulnerable version of Chrome for Android. No authentication is required. The attack is remote and network-based, delivered through any channel that leads a victim to attacker-controlled web content, including phishing links, malvertising, or compromised sites. Successful exploitation targets the sandbox rather than the site's own origin, so the impact is not constrained by same-origin policy.
No public proof-of-concept has been released. Technical details are tracked in the Chromium Issue Tracker Entry and the Google Chrome Update advisory.
Detection Methods for CVE-2026-17651
Indicators of Compromise
- Android devices running Chrome versions earlier than 151.0.7922.72 after the patch became available
- Renderer process crashes or unexpected child process spawns immediately following navigation to unfamiliar sites
- Outbound connections to unknown hosts originating from the Chrome process on Android endpoints
- HTML resources invoking WebGPU APIs with unusually large or malformed descriptor structures
Detection Strategies
- Inventory Chrome for Android versions across managed devices and flag builds below 151.0.7922.72.
- Inspect mobile browsing telemetry for WebGPU usage from low-reputation domains.
- Correlate browser crash reports with subsequent process or network anomalies on the same device.
Monitoring Recommendations
- Enable mobile threat defense telemetry to capture Chrome crash signatures and unexpected privilege transitions.
- Log DNS and HTTP requests from mobile fleets to identify traffic to crafted exploit pages.
- Monitor enterprise mobility management (EMM) reports for devices lagging on Chrome updates.
How to Mitigate CVE-2026-17651
Immediate Actions Required
- Update Chrome on Android to 151.0.7922.72 or later through Google Play immediately.
- Enforce minimum Chrome version policies through EMM or MDM tooling for corporate devices.
- Restrict use of Chromium-based browsers on Android that have not incorporated the fixed Dawn revision.
Patch Information
Google released the fix in the Stable channel update announced on the Chrome Releases blog. Users on Android should upgrade Chrome to version 151.0.7922.72 or newer. Downstream Chromium browsers should merge the corresponding Dawn fix before being considered patched.
Workarounds
- Disable WebGPU features via enterprise policy on Android where feasible until updates are applied.
- Route mobile browsing through a secure web gateway that blocks high-risk or uncategorized sites.
- Advise users to avoid untrusted links on Android devices until the Chrome update is confirmed installed.
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 151.0.7922.72 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
