Executive brief
Google Chrome on Android is affected by a security vulnerability that could allow a malicious website to bypass the browser's security sandbox. The sandbox is a critical defense layer designed to prevent malicious code from escaping the browser and interacting with the rest of the mobile device. If successfully exploited, an attacker who has already gained control over a web page's rendering process could potentially access more sensitive parts of the system.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Text component of Google Chrome for Android. The flaw allows a remote attacker who has already compromised the renderer process to perform a sandbox escape by convincing a user to visit a specially crafted HTML page. By providing untrusted input that is not correctly validated, the attacker can break out of the restricted environment intended to isolate web content from the underlying operating system. This vulnerability is addressed in version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched