CVE-2026-14106: Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150

Synopsis

This is an insufficient input validation vulnerability in the Text component of Google Chrome on Android, affecting all versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page; additionally, the attacker must have already compromised the Chrome renderer process as a precondition. Successful exploitation enables a full sandbox escape, granting the attacker read access to confidential data, the ability to tamper with data, and the ability to crash or disrupt the affected application. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials are needed on the target system; the attack originates from an unauthenticated remote position.

• Victim interactionRequired

  The victim must navigate to or be social-engineered into loading the attacker-controlled HTML page in the Chrome browser.

• Attack complexityDetail

  The exploit is reliable and condition-free once triggered, though it carries the implicit precondition that the attacker has already achieved renderer process compromise before attempting the sandbox escape.

Blast Radius

• A successful sandbox escape breaks out of Chrome's security boundary on the Android device, exposing data readable by the Chrome process such as stored credentials, session tokens, and browsing history.
• The attacker gains the ability to write or modify data within the escaped context, including tampering with files or application state accessible to Chrome on the device.
• Full compromise of confidentiality, integrity, and availability is achievable at the scope of the affected Chrome instance and any cross-origin resources it can reach, consistent with the CVSS Scope:Changed rating.
• Service disruption of the Chrome browser and dependent in-app browsing surfaces is within attacker reach.