What is the CVSS score of CVE-2026-13851?

CVE-2026-13851 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13851?

Google Chrome for Android versions before 150.0.7871.47 contain a critical access-control bypass (CVE-2026-13851, CVSS 9.1) that allows attackers to modify installed web applications on affected…. A patch is available.

How to fix or mitigate CVE-2026-13851?

Within 24 hours: Inventory Chrome for Android deployment scope across managed and unmanaged devices; notify mobile device management (MDM) team to prepare patch deployment. Within 7 days: Deploy Google Chrome for Android version 150.0.7871.47+ via MDM; validate web application functionality post-update. Within 30 days: Confirm 100% patch coverage on organizational Android devices; document remediation completion and monitor mobile security logs for exploitation attempts.

Google Chrome CVE-2026-13851

EUVD-2026-40537 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-xh8q-x6hw-jhv5

Authentication Bypass Google Red Hat Suse

9.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

A crafted HTML page requires the victim to navigate to it, so UI:R; impact is an access-control/integrity bypass (I:H) with no confidentiality loss and no clear availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.9 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:23 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.1

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Access-control bypass in Google Chrome for Android before 150.0.7871.47 allows an attacker to subvert discretionary access controls through the WebAppInstalls component by serving a crafted HTML page, stemming from insufficient validation of untrusted input. Rated High by Chromium and scored CVSS 9.1, the flaw carries high integrity and availability impact but no confidentiality loss; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).

Technical ContextAI

The vulnerability lives in Chrome's WebAppInstalls subsystem, the machinery that handles Progressive Web App (PWA) installation and the association of web content with installed app identities on Android. The root cause is classified as CWE-20 (Improper Input Validation): untrusted input processed during a web-app install flow is not adequately validated, letting a crafted HTML page influence a security decision it should not control. Because the affected surface is app installation and the DAC/permission model that governs what an installed web app may do, a successful bypass undermines the isolation boundaries Android and Chrome enforce between web origins and installed app contexts. The affected component is the Chrome browser for Android specifically (no CPE strings were provided in the input to further narrow the platform).

RemediationAI

Vendor-released patch: update Google Chrome for Android to 150.0.7871.47 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Most Android devices receive Chrome updates automatically through Google Play, so ensure Play Store auto-updates are enabled and force an update check on managed fleets; MDM administrators should push the minimum-version requirement to enrolled devices. Because the affected surface is web-app installation, an interim compensating control is to restrict or disable PWA/web-app installation via enterprise policy (e.g., WebAppInstallForceList / blocking user-initiated installs through Chrome management), which reduces exposure to the WebAppInstalls flow at the cost of losing PWA functionality; user awareness against visiting untrusted pages offers only marginal, unreliable protection. Given the low complexity of updating and that a fixed build exists, patching is strongly preferred over workarounds.