CVE-2026-9987: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148

Synopsis

Insufficient input validation in the WebAppInstalls component of Google Chrome for Android allows a local attacker to execute arbitrary code via a malicious file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates the attacker needs local access to the device and must get the target user to interact with a crafted file, but no account credentials are required. Successful exploitation gives the attacker full read, write, and execution access within the context of the Chrome process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target service is required.

• AuthenticationNot required

  No account credentials or privilege level are required to attempt exploitation.

• Victim interactionRequired

  The target user must open or otherwise interact with a malicious file, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome process on the affected Android device.
• The attacker reads any data accessible to Chrome, including stored session tokens, saved passwords, cookies, and browsing history.
• The attacker modifies or deletes Chrome-managed storage, including cached files and locally persisted web app data.
• The attacker crashes or destabilizes the Chrome process, causing denial of service for the browser and any hosted web apps.