CVE Intelligence
Analysis AI-assisted

CVE-2026-13872: Google Chrome for Android WebAppInstalls Improper Input Validation Leading to Possible Sandbox Escape

CVE-2026-13872 is an improper input validation issue in the WebAppInstalls component of Google Chrome on Android, affecting versions prior to 150.0.7871.47. The record describes a local attacker using a malicious file to potentially escape the browser sandbox. The vendor fix is indicated by the affected version boundary, and the record reports a CVSS 3.1 base score of 9.1 with a network attack vector, which conflicts with the local attacker scenario described.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13872 concerns insufficient validation of untrusted input in the WebAppInstalls component of Google Chrome on Android. According to the record, a malicious file could potentially lead to a sandbox escape. The CNA is Google (chrome-cve-admin), and the published date in the record is 2026-06-30.

Impact

  • The record states a potential sandbox escape, which would move code execution beyond the browser's restricted process boundary.
  • The record reports a CVSS 3.1 base score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which indicates high integrity and availability impact.
  • The description classifies the Chromium security severity as Medium, which differs from the numeric CVSS score. The reason for this difference is not stated in the sources consulted.

Affected products and versions

  • Google Chrome on Android with versions prior to 150.0.7871.47.
  • The record's fixes list is empty. The description's version boundary implies that 150.0.7871.47 and later are not affected, but no separate fixed-version entry is provided.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted, and this analysis does not claim active exploitation.

Remediation and mitigation

  • Update Google Chrome on Android to version 150.0.7871.47 or later, as indicated by the affected version boundary in the record.
  • Consult the vendor release notes linked in the references to confirm the exact build available through your update channel.
  • Until updates are applied, limit the handling of untrusted files on managed Android devices and keep browser auto-update enabled.

Detection guidance

  • Inventory Android devices that run Chrome and record their installed browser version.
  • Flag devices running Chrome builds earlier than 150.0.7871.47 for prioritized update.
  • Monitor mobile device management logs for unexpected installation or handling of files from untrusted sources, at a general level.

Limitations of the available information

  • The record does not name the CVSS provider, and the source UUID cannot be mapped to a named organization from the data provided.
  • The attack vector in the CVSS vector (network) conflicts with the local attacker scenario in the description. Both facts are reported as-is and the discrepancy is unresolved.
  • The technical details of the WebAppInstalls flaw are not provided in the record, and the issue tracker entry is restricted.
  • The EPSS data includes a date of 2026-10-13, which is later than the published date. It is reported as given.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-13872?

The record lists Google Chrome on Android versions prior to 150.0.7871.47 as affected. Versions from 150.0.7871.47 onward are not described as affected.

Is CVE-2026-13872 known to be exploited in the wild?

The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Update Chrome on Android to 150.0.7871.47 or later and review the vendor release notes to confirm the build available for your devices.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.