Description
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-07-30
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from insufficient validation of untrusted input in the Dawn rendering engine of Google Chrome on Android. A crafted HTML page can trigger a sandbox escape, providing a remote attacker with the potential to execute arbitrary code with higher privileges. The weakness corresponds to CWE‑20, reflecting input validation failures that compromise confidentiality, integrity, and availability of the affected device.

Affected Systems

Google Chrome for Android versions prior to 151.0.7922.72. The affected product is Chrome’s Stable channel on Android devices running those firmware releases.

Risk and Exploitability

The CVSS score is 9.6, indicating a high severity exploit scenario. The EPSS score is less than 1%, suggesting a very low probability of exploitation under current conditions. It is not listed in the CISA KEV catalog, and the attack vector is inferred to be a remote attacker delivering a malicious HTML page to a vulnerable device. No public exploit has been disclosed, but the potential impact warrants urgent attention.

Generated by OpenCVE AI on August 3, 2026 at 12:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 151.0.7922.72 or later.
  • Configure enterprise policies to force the latest Chrome version on all Android devices.
  • Monitor network traffic for anomalous HTML requests that could indicate active exploitation attempts.

Generated by OpenCVE AI on August 3, 2026 at 12:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Sat, 01 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Sandbox Escape via Untrusted Input in Chrome Dawn on Android chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn
Weaknesses CWE-79
References
Metrics threat_severity

None

 threat_severity

Critical

Fri, 31 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Sandbox Escape via Untrusted Input in Chrome Dawn on Android

Fri, 31 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-20
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T03:56:24.309Z

Reserved: 2026-07-27T23:34:14.211Z

Link: CVE-2026-17651

cve-icon Vulnrichment

Updated: 2026-07-30T20:49:06.647Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:26.967

Modified: 2026-08-03T12:13:26.900

Link: CVE-2026-17651

cve-icon Redhat

Severity : Critical

Publid Date: 2026-07-30T00:18:42Z

Links: CVE-2026-17651 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')