What is the CVSS score of CVE-2026-13852?

CVE-2026-13852 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13852?

Google released a critical security patch for Chrome on Android (version 150.0.7871.47 and later) addressing a discretionary access control bypass in the WebAppInstalls component.. A patch is available.

How to fix or mitigate CVE-2026-13852?

24 hours: Identify Chrome for Android instances in your managed device fleet and establish current version distribution using your MDM platform. 7 days: Deploy Chrome version 150.0.7871.47 or later through MDM policies; provide user guidance for personal device updates via Google Play Store. 30 days: Verify patch adoption reaches 95% on managed devices and document remediation completion for compliance records.

Google Chrome CVE-2026-13852

EUVD-2026-40538 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7m35-34rv-pmwh

Authentication Bypass Google Red Hat Suse

9.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Delivery via a crafted HTML page means the victim must render attacker content, so UI:R rather than UI:N; no auth needed (PR:N) and impact is integrity/availability only (C:N), giving base 8.8.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:23 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.1

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).

Technical ContextAI

The flaw lives in Chrome's WebAppInstalls machinery, the subsystem that handles Progressive Web App / web app installation and manifest processing on Android. Rooted in CWE-20 (Improper Input Validation), the code fails to sufficiently validate untrusted input reachable from web content, so a maliciously crafted HTML page can drive the install path into an unintended state that circumvents Android's discretionary access control (the app-sandbox / permission model). Because WebAppInstalls straddles the boundary between untrusted web content and privileged installation actions, weak validation there translates directly into a trust-boundary violation rather than a mere page-level bug.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 150.0.7871.47 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). On most devices Chrome updates automatically through Google Play, so the primary action is to confirm the installed version is at or above 150.0.7871.47 and force a Play Store update on any lagging fleet devices via MDM/managed-Play policies. There is no documented configuration workaround; as an interim compensating control you can reduce exposure by discouraging installation of web apps (PWAs) from untrusted sites and, in managed environments, restrict which origins users can install web apps from - with the trade-off that this degrades legitimate PWA workflows. Because the vulnerable component is triggered by rendering crafted web content, avoiding untrusted links and keeping the browser current remains the effective mitigation until every device is on the patched build.