CVE Intelligence
Analysis AI-assisted

CVE-2026-13934: Google Chrome on Android: Dawn Sandbox Escape via Improper Input Validation

CVE-2026-13934 affects Dawn, a component of Google Chrome on Android before 150.0.7871.47. A remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The CVSS 3.1 base score of 9.6 is critical, and the record shows no KEV listing or confirmed active exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13934 is an improper input validation issue (CWE-20) in Dawn, a component of Google Chrome on Android. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The Chromium security severity is listed as Medium.

Impact

  • A sandbox escape would extend an attacker's reach beyond the renderer process.
  • The CVSS 3.1 base score is 9.6 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The CNA score is mirrored by CISA-ADP.
  • The vector reflects network access, no privileges required, user interaction required, scope change and high confidentiality, integrity and availability impact.
  • SSVC fields in the record show technical impact total, automatable no and exploitation none.

Affected products and versions

  • Google Chrome on Android prior to 150.0.7871.47, as stated in the description.
  • The record contains a second range, '≥ 150.0.7871.47 and < 150.0.7871.47', which is self-contradictory. It should not be relied on without checking the vendor release notes.
  • The fixes list in the record is empty. The stable channel update linked in the references is the vendor source to consult for the fixed build.

Exploitation status

  • The KEV listing is false in the record.
  • No confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is 0.00345 with a percentile of 0.26191, as recorded.
  • The SSVC exploitation value is none.

Remediation and mitigation

  • Update Chrome on Android to 150.0.7871.47 or later, as indicated by the affected boundary in the description and the Chrome stable channel update.
  • Prioritize devices used to browse untrusted or unfamiliar web content.
  • Keep automatic browser updates enabled and verify update status on managed devices.

Detection guidance

  • Use mobile device management to inventory Chrome versions across Android devices.
  • Flag devices reporting a Chrome build below 150.0.7871.47 for remediation.
  • Review mobile security telemetry for unusual browser crashes or renderer anomalies, treating these as indicators to investigate rather than confirmed compromise.

Limitations of the available information

  • The record does not describe the exact location or nature of the input validation flaw in Dawn.
  • The affected version range is internally contradictory.
  • The issue tracker reference is tagged Permissions Required, so its full content may not be accessible.
  • The EPSS date (2026-10-13) is later than the publication date (2026-06-30), so the score should be interpreted with caution.

Frequently asked questions

Which Chrome for Android versions are affected by CVE-2026-13934?

The description states that versions prior to 150.0.7871.47 are affected. The affected range in the record also contains a contradictory second entry, so verify against the vendor release notes.

Is CVE-2026-13934 being actively exploited?

The record shows no KEV listing, and no confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.