PT-2026-54149 · Google · Chrome On Android

Published 2026-06-30 · Updated 2026-07-01 · CVE-2026-13872

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47

Description Insufficient validation of untrusted input in the WebAppInstalls component occurs when handling Web App install-related data. This trust boundary failure allows crafted file content to be processed in an unsafe manner. A local attacker can exploit this by inducing a user to open or import a malicious file via downloads, share intents, or attachments. Successful exploitation can lead to a sandbox escape, which may allow code execution in a higher-privileged context and unauthorized data access beyond the renderer sandbox.

Recommendations Update Google Chrome on Android to version 150.0.7871.47 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-13872

Affected Products

Chrome On Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-13872 · Security Note
• https://issues.chromium.org/issues/497977983 · Note
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html · Note
• https://twitter.com/UpwindMDR/status/2072365548533358903 · Twitter Post