CVE Intelligence
Analysis AI-assisted

CVE-2026-13851: Google Chrome Android WebAppInstalls Improper Input Validation

CVE-2026-13851 is an improper input validation issue in the WebAppInstalls component of Google Chrome on Android before 150.0.7871.47. The record states that a local attacker can bypass discretionary access control using a crafted HTML page. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Google Chrome for Android contains an input validation weakness in the WebAppInstalls component. According to the CVE record, insufficient validation of untrusted input allows a local attacker to bypass discretionary access control through a crafted HTML page. The record classifies the weakness as CWE-20 (Improper Input Validation).

Impact

  • The record describes a bypass of discretionary access control. The protected resources affected and the resulting consequences are unknown from the record.
  • The CVSS 3.1 vector in the record reports no confidentiality impact and high integrity and availability impact. The score reported is 9.1.

Affected products and versions

  • Google Chrome on Android prior to 150.0.7871.47 (record range: < 150.0.7871.47).
  • No other products or version ranges are listed in the record.

Exploitation status

The CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome on Android to version 150.0.7871.47 or later, as stated in the record description.
  • Review the Chrome stable channel release notes for update details.
  • Where browser updates are centrally managed, confirm that managed Android devices actually receive the update.

Detection guidance

  • Inventory Chrome versions on Android devices and flag installations older than 150.0.7871.47.
  • Review mobile device management reports for devices that still run older browser builds.
  • Monitor for unexpected web app installation activity on managed devices as a general defensive signal. The record does not describe specific indicators.

Limitations of the available information

  • The record does not describe the protected resources bypassed or the conditions required for exploitation.
  • The description refers to a local attacker, while the CVSS vector uses AV:N (network). The record does not resolve this inconsistency.
  • The fixes list in the record is empty. The fixed version is taken from the description and the affected range.
  • The Chromium issue tracker entry is referenced in the record, but its contents were not available for this analysis.

Frequently asked questions

What does CVE-2026-13851 affect?

According to the record, it affects Google Chrome on Android versions prior to 150.0.7871.47.

Is this CVE known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Chrome on Android to 150.0.7871.47 or later and verify that managed devices have received the update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.