EUVD-2026-65897
GHSA-r2rq-89f6-2v94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker crafts malicious HTML page
-
DeliveryHost page at attacker-controlled URL
-
ExploitDeliver link to Android Chrome user via phishing or ad
-
InstallVictim visits page in Chrome < 152.0.7977.65
-
C2WebAppInstalls authorization check triggered incorrectly
-
ExecuteSystem access restrictions bypassed
-
ImpactUnauthorized web app installation action performed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit a crafted HTML page using a vulnerable version of Google Chrome on Android (any version prior to 152.0.7977.65). This is confirmed by CVSS UI:R (passive user interaction). The vulnerability is platform-specific: it affects Chrome on Android only, as the WebAppInstalls component interfaces with Android system restrictions. No authentication or account privileges are needed from the attacker (PR:N). No special non-default configuration is required on the victim device. Exploitation is limited by the requirement for user interaction, the Android-only scope, and the absence of confidentiality or availability impact - the bypass is constrained to integrity effects within the WebAppInstalls authorization boundary. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores 4.3 Medium. The network vector and lack of required privileges lower the exploitation barrier, but mandatory user interaction (UI:R - victim must visit a crafted page) meaningfully constrains opportunistic mass exploitation. The scope is unchanged (S:U), and impact is limited solely to integrity (I:L), with no confidentiality or availability consequences. EPSS at 0.24% (15th percentile) corroborates low real-world exploitation activity. No POC is publicly known and the vulnerability is not listed in CISA KEV. Chromium internally rated this Medium severity. Overall, this is a genuine but lower-priority vulnerability: the integrity bypass matters for Android PWA trust boundaries, but the limited impact and required user interaction reduce urgency relative to higher-severity Chrome flaws. The primary risk is unauthorized or spoofed web app installation actions on Android devices. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to trigger the incorrect authorization logic in Chrome's WebAppInstalls component. The victim, running a vulnerable version of Chrome on Android, visits the page - for example, via a phishing link or malicious ad. Chrome's WebAppInstalls authorization check evaluates incorrectly, allowing the attacker's page to bypass system access restrictions, potentially triggering unauthorized PWA installation actions or circumventing Android's app trust boundaries. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
RemediationAI
Update Google Chrome on Android to version 152.0.7977.65 or later, which contains the vendor-released patch per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Android users should ensure Chrome auto-updates are enabled via the Google Play Store. As an interim compensating control for environments where immediate update is not possible, administrators managing Android fleets via MDM can restrict user-initiated PWA installation through enterprise policy (ChromeWebAppInstallForce or equivalent restrictions), which would reduce exposure to the WebAppInstalls code path. This control's trade-off is that it also prevents legitimate PWA deployments. Users should avoid visiting untrusted web pages on unpatched Android Chrome installations until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the WebAppInstalls subsystem of Google Chrome on Android, which governs the installation of Progressive Web Apps (PWAs) and related web application integration with the Android platform. CWE-863 (Incorrect Authorization) indicates that the authorization logic is implemented but applied erroneously - access control checks are performed but produce incorrect outcomes when processing a specially crafted HTML page, permitting actions that should be denied. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Android. This component interfaces with Android's system-level app installation restrictions, making authorization bypass in this context significant despite the limited CVSS impact scores.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery via crafted page requires user interaction (UI:R); no credentials needed (PR:N); impact limited to low integrity bypass, no confidentiality or availability loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB