CVE-2026-14106: Android Chrome Sandbox Escape — Detection and Remediation Guide

---
title: Identify Android Chrome Versions Vulnerable to CVE-2026-14106
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects Android Chrome versions prior to 150.0.7871.47 (vulnerable to CVE-2026-14106) via proxy logs. This helps identify assets requiring immediate patching.
references:
 - https://nvd.nist.gov/vuln/detail/CVE-2026-14106
author: Security Arsenal
date: 2026/04/06
tags:
 - configuration.audit
 - cve.2026.14106
 - mobile
group:
 - critical_infrastructure
logsource:
 category: proxy
 product: null
detection:
 selection:
 c-useragent|contains:
   - 'Android'
   - 'Chrome'
 filter_current:
 # Matches versions 149.x.x.x or lower, or 150.0.7871.46 and below
 c-useragent|re: 'Chrome/(1[0-4][0-9]|[0-9][0-9]|[1-9])\\.|Chrome/150\\.0\\.(7[0-8][0-9][0-9]|6[0-9]{3}|[0-5]{0,4})'
 condition: selection and not filter_current
falsepositives:
  - User agents spoofing older versions for compatibility
level: high
---
title: Potential Chrome Sandbox Escape on Android
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects Google Chrome on Android spawning a shell (sh) or system binary, indicative of a sandbox escape or post-exploitation activity.
references:
 - https://nvd.nist.gov/vuln/detail/CVE-2026-14106
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059
 - attack.privilege_escalation
 - cve.2026-14106
logsource:
 product: android
 category: process_creation
detection:
 selection_parent:
 ParentImage|endswith: '/com.android.chrome'
 selection_child:
 Image|endswith:
   - '/sh'
   - '/su'
   - '/bin/sh'
   - '/system/bin/sh'
 condition: selection_parent and selection_child
falsepositives:
  - Legitimate developer debugging or rare automation workflows
level: critical

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "com.android.chrome"
| where FileName in~ ("sh", "su", "bash", "cursh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for vulnerable Chrome versions and suspicious process chains
SELECT 
  OSPath.Basename as PackageName,
  Version as PackageVersion,
  Mtime as LastModified
FROM glob(globs="/data/app/*/com.android.chrome*/base.apk")
-- Parse version from package manager if available, otherwise check APK stat
WHERE PackageName = "base.apk"
-- Note: Precise version parsing usually requires pm dump, this is a quick file stat check

-- Complementary check for Chrome spawning shell
SELECT Pid, Ppid, Name, Exe, Cwd, Username, CommandLine
FROM pslist()
WHERE Name =~ "chrome" 
   OR (Name =~ "sh" AND Pid IN (
       SELECT Pid FROM pslist() WHERE Ppid IN (
           SELECT Pid FROM pslist() WHERE Name =~ "chrome"
       )
   ))

#!/bin/bash

# Audit script for CVE-2026-14106
# Checks Google Chrome version on Android devices

VULN_VERSION="150.0.7871.47"
PACKAGE_NAME="com.android.chrome"

echo "Checking Chrome version for CVE-2026-14106..."

# Get version string using dumpsys package
VERSION_STRING=$(dumpsys package $PACKAGE_NAME | grep versionName | head -n 1 | awk '{print $1}')

# Extract version value (cleanup if prefix exists)
CURRENT_VERSION=$(echo $VERSION_STRING | cut -d'=' -f2)

echo "Current Chrome Version: $CURRENT_VERSION"

# Check if package exists
if [ -z "$CURRENT_VERSION" ]; then
    echo "Chrome not installed or inaccessible."
    exit 1
fi

# Simple string comparison for versions (requires sort -V for robust version check)
# Assuming standard GNU coreutils availability in the Android shell environment
if [ "$(printf '%s\n' "$VULN_VERSION" "$CURRENT_VERSION" | sort -V | head -n1)" != "$VULN_VERSION" ]; then
    echo "[SAFE] Device is running a version newer than the patch: $CURRENT_VERSION"
else
    echo "[VULNERABLE] Device is running a vulnerable version: $CURRENT_VERSION"
    echo "Action Required: Update Google Chrome via Google Play Store immediately."
fi