CVE-2026-13852: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150

Synopsis

Insufficient input validation in the WebAppInstalls component of Google Chrome on Android allows a network-reachable attacker with no authentication to bypass discretionary access control via a crafted HTML page. The CVSS vector scores this at 9.1 Critical, reflecting high impact to both integrity and availability with no barriers to exploitation. A patched-image rebuild at Chrome 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network to a vulnerable Chrome on Android instance, requiring the target device to be reachable or browsing attacker-controlled content.

• AuthenticationNot required

  No account or credential of any kind is required; the exploit is reachable by any unauthenticated party who can serve or link to a crafted HTML page.

• Victim interactionNot required

  No user action beyond normal browsing is required for the crafted page to trigger the insufficient validation flaw.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions to succeed.

Blast Radius

• The attacker bypasses discretionary access control, writing or modifying data in storage or filesystem locations that Chrome on Android would normally restrict.
• The attacker causes high availability impact, crashing or destabilizing the Chrome browser process or a dependent subsystem on the target device.
• A successful exploit may allow installation or modification of web app manifests and associated data without user consent, altering what applications appear installed on the device.
• Combined integrity and availability loss on the affected Android device can disrupt browser-dependent workflows and expose locally persisted browser data to unauthorized writes.