CVE-2026-14401: Chrome Android Sandbox Escape via ANGLE Graphics Vulnerability

Technical summary

CVE-2026-14401 is an insufficient input validation flaw (CWE-20) in ANGLE, Google's abstraction layer for graphics APIs used by Chrome on Android. The vulnerability permits a compromised renderer process to execute a sandbox escape attack via a specially crafted HTML page. The attack chain requires the attacker to first gain code execution within the sandboxed renderer context, then exploit this validation weakness to escalate privileges and access system resources outside the sandbox boundary. The vulnerability carries a CVSS 3.1 score of 8.3 (HIGH), reflecting the high confidentiality, integrity, and availability impact, though exploitation requires prior renderer compromise and user interaction.

Business impact

While this vulnerability requires an initial renderer compromise, successful exploitation could allow an attacker to bypass Chrome's sandbox isolation—a critical security boundary designed to contain malicious web content. If leveraged in a real-world attack chain, an attacker could gain full Android system access, potentially compromising user data, installing malware, or taking control of the device. For organizations deploying Chrome on corporate Android devices, this represents a significant risk to data confidentiality and device integrity.

Affected systems

Google Chrome on Android devices running version 150.0.7871.46 and earlier are vulnerable. The issue does not affect Chrome on other platforms (Windows, macOS, Linux, iOS) or other Android browsers. Organizations should identify inventory of Android devices using affected Chrome versions, particularly in mobile device management (MDM) environments.

Exploitability

Exploitation requires two conditions: first, an attacker must compromise the Chrome renderer process (typically through a separate web-based vulnerability or social engineering), and second, the user must interact with a malicious HTML page while the renderer is compromised. While the sandbox escape itself may not require user interaction after renderer compromise, the initial compromise and page delivery require either user action or a concurrent vulnerability. The attack is not trivial but becomes more likely in targeted scenarios against high-value users.

Remediation

Users should update Google Chrome on Android devices to version 150.0.7871.46 or later as soon as updates become available. Organizations should enforce automatic updates or mandate manual updates through their MDM solutions. In the interim, security controls should focus on preventing initial renderer compromise through extension policy, phishing awareness training, and restricting access to untrusted websites on corporate devices.

Patch guidance

Apply Chrome updates for Android through Google Play Store or automatic update mechanisms. Verify the installed Chrome version under Settings > Apps > Chrome > About Chrome; the version will auto-update if a newer release is available. For managed environments, use MDM solutions to enforce Chrome updates across enrolled Android devices. Testing patches in non-production environments is not typically necessary for Chrome updates but organizations may want to confirm compatibility with critical business applications.

Detection guidance

Monitor for Chrome crashes or unexpected restarts on Android devices, which may indicate sandbox escape attempts. In enterprise environments, enable detailed logging if available through MDM platforms to track Chrome version compliance. Behavioral detection is challenging at the endpoint without specialized instrumentation; detection is primarily preventive through timely patching. Consider monitoring for unusual system-level access patterns following renderer crashes on monitored Android devices, though this requires advanced endpoint detection capabilities.

Why prioritize this

This vulnerability merits priority remediation because it enables complete sandbox bypass in Chrome—one of the most widely deployed browsers on Android. Although it requires an initial renderer compromise, the potential impact is severe: successful exploitation grants system-level access. The large user base of Chrome on Android and the sensitivity of mobile devices to data theft make this a material risk. Prioritize patching devices used for sensitive work or containing sensitive data.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects HIGH severity due to confidentiality, integrity, and availability impacts (all rated HIGH), combined with network attack vector and user interaction requirement. The score does not account for the prerequisite renderer compromise, which is captured in the Attack Complexity (High) rating. The score appropriately reflects that while exploitation requires setup, the impact is catastrophic—full system compromise via sandbox escape.

Frequently asked questions