CVE-2026-13934: Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150

Synopsis

This is an input-validation flaw in Dawn, the WebGPU implementation inside Google Chrome on Android, affecting versions prior to 150.0.7871.47. The vulnerability is reachable over the network with no authentication required, but requires a victim to visit a crafted HTML page and assumes the attacker has already compromised the renderer process. Successful exploitation enables a full sandbox escape, giving the attacker code execution outside the Chrome sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected service must be reachable from an internet or network-adjacent origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user browsing to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must open a crafted HTML page in Chrome on Android, making this a social-engineering vector that requires luring the user to attacker-controlled content.

• Attack complexityDetail

  The base exploit is condition-free and reliable once the renderer process has been compromised, though chaining a renderer compromise first adds practical complexity outside the scope of this CVE's CVSS score.

Blast Radius

• Attacker breaks out of the Chrome sandbox and executes arbitrary code in the context of the hosting Android process, outside the browser's normal containment.
• With sandbox escape, the attacker reads files, credentials, and session data accessible to the Chrome process on the device.
• The attacker can write or modify data stored by Chrome, including cookies, cached credentials, and locally persisted application state.
• The attacker can crash or destabilize the Chrome process and any dependent services, causing denial of service on the affected device.