CVE-2026-13852: Google Chrome for Android WebAppInstalls Input Validation Flaw
CVE-2026-13852 is an improper input validation flaw in the WebAppInstalls component of Google Chrome on Android, affecting versions prior to 150.0.7871.47 according to the record description. The CNA and CISA-ADP both list a CVSS 3.1 score of 9.1, but the vector's network attack vector does not match the description of a local attacker. No confirmed exploitation appears in the sources consulted.
Overview
The record describes insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android. According to the description, a crafted HTML page could allow a local attacker to bypass discretionary access control. The weakness is classified as CWE-20, Improper Input Validation.
Impact
- The description states that discretionary access control can be bypassed.
- The CVSS 3.1 vector lists high integrity and high availability impact, with no confidentiality impact. The score of 9.1 is supplied by the CNA and repeated by CISA-ADP.
- SSVC data in the record rates technical impact as total and automatable as yes.
- The description says local attacker, while the vector uses network attack vector (AV:N). The precise attack vector should be treated as unresolved until the vendor clarifies it.
Affected products and versions
- Google Chrome on Android, in versions described as prior to 150.0.7871.47.
- The structured affected range is internally inconsistent: one entry reads less than 150.0.7871.47, and a second entry reads 150.0.7871.47 or later but less than 150.0.7871.47, which is an empty range. The description is treated as the primary statement.
- No fixed-version field is populated. The threshold in the description suggests 150.0.7871.47 as the first version without the flaw, which is an inference.
Exploitation status
- The record shows KEV listing as false. No confirmed exploitation in the wild appears in the sources consulted.
- SSVC exploitation is set to none. The record gives an EPSS probability of 0.0031 with a percentile of 0.2213.
Remediation and mitigation
- Update Google Chrome on Android to version 150.0.7871.47 or later, following the vendor stable channel release notes.
- Confirm update status across managed Android devices and prioritize devices used for sensitive work.
- Until updates are applied, limit browsing to trusted sites and restrict installation of web apps from untrusted sources, at a high level.
Detection guidance
- Inventory Chrome versions on Android devices and flag any build older than 150.0.7871.47.
- Use mobile device management telemetry to find outdated browser builds.
- Review unusual web app installation activity at a general level. The sources consulted do not publish specific indicators of compromise.
Limitations of the available information
- The Chromium issue tracker entry is restricted to permitted users, so technical details are not available from the sources consulted.
- The title was null in the record. The title used here is derived from the description.
- The vector and description conflict on attack vector, the affected range is empty, no fixed-version field is populated, and the EPSS date is later than the publication date. These points should be checked against primary sources such as NVD.
Frequently asked questions
What does CVE-2026-13852 affect?
According to the record description, it affects Google Chrome on Android in versions prior to 150.0.7871.47, in the WebAppInstalls component.
Is this vulnerability known to be exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. SSVC exploitation is set to none.
What should administrators do?
Update Chrome on Android to 150.0.7871.47 or later, verify update status on managed devices, and follow the vendor release notes for any further guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.