CVE-2026-13852

CriticalCVSS 9.1

Published: 30/06/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile — higher than 19% of all known CVEs

Summary

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allows a local attacker to bypass discretionary access control via a crafted HTML page.

Risk Assessment

The risk involves a local attacker bypassing access control mechanisms, potentially leading to unauthorized access to data or application features.

Recommendation

It is recommended to immediately update Google Chrome on Android to version 150.0.7871.47 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)