What is the CVSS score of CVE-2026-13872?

CVE-2026-13872 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13872?

Google Chrome for Android versions before 150.0.7871.47 contain a critical sandbox escape vulnerability that could allow a local attacker to break out of the browser security boundary and access all…. A patch is available.

How to fix or mitigate CVE-2026-13872?

Within 24 hours: Inventory all Android devices running Chrome before version 150.0.7871.47 using mobile device management (MDM) or enterprise inventory tools. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all Android devices through MDM with mandatory update enforcement; prioritize managed corporate devices. Within 30 days: Verify 100% update completion; isolate or retire any non-compliant devices that cannot be updated.

Google Chrome CVE-2026-13872

EUVD-2026-40558 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-pmm6-hfr7-6gqf

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.1 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.5 HIGH

Description says local attacker via a malicious file, so AV:L and UI:R; sandbox escape crosses the isolation boundary giving S:C with high integrity/availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:27 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a local attacker break out of the renderer/browser sandbox by feeding a malicious file into the WebAppInstalls component, which insufficiently validates untrusted input (CWE-20). Chromium rates the security severity as Medium, and no public exploit has been identified at time of analysis; EPSS estimates only a 0.13% (3rd percentile) chance of exploitation in the next 30 days. A vendor patch is available in Chrome 150.0.7871.47.

Technical ContextAI

The flaw sits in Chrome's WebAppInstalls handling on Android - the subsystem responsible for installing Progressive Web Apps / web apps and processing their associated files and manifests. The root cause is CWE-20 (Improper Input Validation): untrusted input (a crafted file) is accepted and acted upon without sufficient validation, allowing an attacker to cross the boundary Chrome's multi-process sandbox is designed to enforce. Because the vector is a locally supplied malicious file rather than a remote network payload, exploitation depends on the Android device processing attacker-controlled file content through the installation code path. Affected component per EUVD is the Chrome browser (Android channel) at versions below 150.0.7871.47; no CPE strings were provided in the source data.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 150.0.7871.47 or later via Google Play or Chrome's built-in updater, then restart the browser to complete the update; this is the primary and sufficient fix. Verify the running version under Chrome > Settings > About Chrome. Until the update lands, the practical compensating control is behavioral: avoid opening or importing untrusted files into Chrome and do not install web apps (WebAppInstalls) from untrusted sources, since the trigger is a malicious local file processed by the install path - the trade-off is loss of PWA/web-app install convenience for affected users. Managed fleets can enforce the update through Android enterprise/MDM policy to guarantee timely rollout. Reference Google's advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and the Chromium issue (https://issues.chromium.org/issues/497977983).