CVE-2026-15115

LowCVSS 3.3

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

2th percentile - higher than 2% of all known CVEs

Summary

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page.

Risk Assessment

A local attacker can bypass browser security mechanisms, potentially gaining unauthorized access to data from other web applications or performing actions in their context.

Recommendation

Immediately update Google Chrome on Android to version 150.0.7871.115 or later. Ensure all Android devices have the latest browser version installed.

Original NVD description (English source)

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)