CVE-2026-17872: Google Chrome Sandbox Escape Vulnerability

CVE-2026-17872 Overview

CVE-2026-17872 is a cryptographic flaw in the WebAppInstalls component of Google Chrome on Android. The vulnerability affects Chrome for Android versions prior to 151.0.7922.72. A local attacker can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google classifies the Chromium security severity as Medium. The issue was resolved in the stable channel update tracked in the Chromium Issue Tracker Entry.

Critical Impact
A local attacker who convinces a user to load a crafted HTML page may bypass Chrome's sandbox isolation on Android, gaining execution outside the constrained renderer environment.

Affected Products

Google Chrome on Android prior to version 151.0.7922.72
The WebAppInstalls component in the Chromium codebase
Downstream Chromium-based Android browsers that inherit the affected code

Discovery Timeline

2026-07-30 - CVE-2026-17872 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17872

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem on Android. This component handles installation flows for progressive web applications (PWAs) and web app manifests. The advisory identifies the root defect as a cryptographic flaw, meaning a security-sensitive cryptographic operation, key handling, signature verification, or randomness source is implemented incorrectly. When a crafted HTML page interacts with the flawed logic, the trust boundary between the renderer sandbox and higher-privileged browser processes can be crossed.

Sandbox escape vulnerabilities in Chrome are notable because the renderer sandbox is Chrome's primary defense against malicious web content. A successful escape allows an attacker to execute code with the privileges of the browser process on the Android device.

Root Cause

Google describes the underlying defect as a cryptographic flaw within WebAppInstalls. Public technical details in the Chromium Issue Tracker Entry remain restricted. The classification indicates weakness in a cryptographic primitive or protocol used to authenticate or validate web app installation state on Android.

Attack Vector

Exploitation requires local access, per the advisory language. The attacker must deliver a crafted HTML page to the target Chrome for Android instance. Once rendered, the page triggers the flawed WebAppInstalls code path. Successful exploitation results in sandbox escape, moving attacker-controlled execution out of the isolated renderer. See the Google Chrome Stable Update advisory for the vendor summary.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation is available at this time.

Detection Methods for CVE-2026-17872

Indicators of Compromise

Chrome for Android installations reporting a version below 151.0.7922.72 in mobile device management (MDM) inventory.
Unexpected web app installation prompts or PWA registrations that do not correlate with legitimate user activity.
Anomalous child processes or file writes originating from the Chrome package on Android endpoints.

Detection Strategies

Query mobile endpoint inventory for the installed Chrome version and flag hosts below the patched build.
Monitor Android application telemetry for Chrome behavior deviating from baseline, including unexpected inter-process communication with WebAppInstalls.
Correlate browser crash reports on Android with visits to unfamiliar or newly registered domains hosting PWA manifests.

Monitoring Recommendations

Enable Chrome enterprise reporting and forward version and crash telemetry into a centralized data lake for continuous review.
Track outbound DNS and HTTP requests from mobile devices to detect suspicious HTML delivery infrastructure.
Review MDM compliance dashboards on a recurring cadence to confirm timely Chrome updates across the fleet.

How to Mitigate CVE-2026-17872

Immediate Actions Required

Update Chrome for Android to version 151.0.7922.72 or later on every managed device.
Push the update through Google Play managed configurations or MDM policy to enforce compliance.
Identify and prioritize devices used for high-value tasks, such as administrative access or authentication, for expedited patching.

Patch Information

Google addressed the vulnerability in Chrome 151.0.7922.72 for Android. Distribution occurs through the stable channel update documented in the Google Chrome Stable Update advisory. Users should confirm the installed build in Chrome under Settings > About Chrome after the update completes.

Workarounds

Restrict browsing to trusted sites on unpatched devices until the update is applied.
Disable or block web app installation prompts through enterprise policy where feasible.
Enforce Google Play auto-update settings so browser updates install without user intervention.

bash

# Verify Chrome for Android version via ADB on managed devices
adb shell dumpsys package com.android.chrome | grep versionName