What is the CVSS score of CVE-2026-13852?

CVE-2026-13852 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13852?

Google released a critical security patch for Chrome on Android (version 150.0.7871.47 and later) addressing a discretionary access control bypass in the WebAppInstalls component.. A patch is available.

How to fix or mitigate CVE-2026-13852?

24 hours: Identify Chrome for Android instances in your managed device fleet and establish current version distribution using your MDM platform. 7 days: Deploy Chrome version 150.0.7871.47 or later through MDM policies; provide user guidance for personal device updates via Google Play Store. 30 days: Verify patch adoption reaches 95% on managed devices and document remediation completion for compliance records.

Google Chrome CVE-2026-13852

EUVD-2026-40538 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7m35-34rv-pmwh

Authentication Bypass Google Suse

9.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Delivery via a crafted HTML page means the victim must render attacker content, so UI:R rather than UI:N; no auth needed (PR:N) and impact is integrity/availability only (C:N), giving base 8.8.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:23 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.1

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page

Delivery

Lure victim's Android Chrome to page

Exploit

Trigger WebAppInstalls input-validation flaw

Execution

Bypass discretionary access control

Impact

Compromise device integrity and availability

Access

Host crafted HTML page

Delivery

Lure victim's Android Chrome to page

Exploit

Trigger WebAppInstalls input-validation flaw

Execution

Bypass discretionary access control

Impact

Compromise device integrity and availability

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to render attacker-controlled content - a crafted HTML page - in Google Chrome for Android on a build earlier than 150.0.7871.47, exercising the WebAppInstalls (web app / PWA install) code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker lures a target using an unpatched Chrome-on-Android build to open a crafted HTML page (via link, ad, or compromised site) that abuses the WebAppInstalls flow to slip past Android's discretionary access controls and perform installation-related actions the user never authorized, affecting device integrity and availability. Given AC:L the technical barrier is low once the page is rendered, but no public exploit or POC is currently known, so weaponization would require original research.
Remediation	Vendor-released patch: update Google Chrome on Android to 150.0.7871.47 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). … Detailed patch versions, workarounds, and compensating controls in full report.