CVE-2026-13872

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47

Description Insufficient validation of untrusted input in the WebAppInstalls component occurs when handling Web App install-related data. This trust boundary failure allows crafted file content to be processed in an unsafe manner. A local attacker can exploit this by inducing a user to open or import a malicious file via downloads, share intents, or attachments. Successful exploitation can lead to a sandbox escape, which may allow code execution in a higher-privileged context and unauthorized data access beyond the renderer sandbox.

Recommendations Update Google Chrome on Android to version 150.0.7871.47 or later.