CVE-2026-13872: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150

Synopsis

Insufficient input validation in the WebAppInstalls component of Google Chrome on Android (versions prior to 150.0.7871.47) allows a network-reachable attacker with no authentication to tamper with the system and disrupt service availability. The CVSS vector reflects no privilege requirement and no victim interaction needed, with high impact to both integrity and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; Chrome on Android exposes this component to remote input by design.

• AuthenticationNot required

  No credentials or account are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need the device user to click a link or take any other action to exploit this flaw.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge.

Blast Radius

• A successful attacker escapes the Chrome sandbox, breaking the isolation boundary that normally confines web content to its own restricted process.
• The attacker gains the ability to modify files and application state on the Android device outside the sandbox, corrupting persisted data or installed web app configurations.
• The attacker can crash or destabilize the Chrome process and dependent components, causing sustained denial of service for the browser and any web apps installed through WebAppInstalls.
• Because sandbox escape can expose process memory and inter-process communication channels, sensitive data handled by the browser process becomes accessible to the attacker.