What is the CVSS score of CVE-2026-9987?

CVE-2026-9987 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9987?

Google Chrome on Android versions prior to 148.0.7778.216 contain a local code execution vulnerability (CVE-2026-9987) that enables attackers to execute arbitrary code if users interact with…. A patch is available.

How to fix or mitigate CVE-2026-9987?

Within 24 hours: Inventory Android devices running Chrome versions prior to 148.0.7778.216 and restrict sideloading on managed devices. Within 7 days: Deploy Chrome security update to version 148.0.7778.216 or later across all organizational and BYOD Android devices through managed deployment channels or official app stores. Within 30 days: Confirm 100% update deployment, audit device logs for suspicious app installation activity, and conduct user security awareness training on file handling risks.

Google Chrome CVE-2026-9987

EUVD-2026-33129 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-3p35-rr8v-cfg2

RCE Google

7.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:23 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

7.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)

AnalysisAI

Local arbitrary code execution in Google Chrome on Android prior to 148.0.7778.216 allows attackers to run code through a malicious file processed by the WebAppInstalls component due to insufficient input validation. The CVSS 7.8 (AV:L/UI:R) reflects that exploitation requires local access and user interaction (opening or installing the malicious file), and no public exploit identified at time of analysis. Chromium-rated High severity and a vendor patch is available in the Stable channel update.

Technical ContextAI

The flaw resides in Chrome's WebAppInstalls subsystem on Android, which handles installation of Progressive Web Apps (PWAs) and web app manifests/files into the device. The root cause is CWE-20 (Improper Input Validation): untrusted input from a file passed into the installation flow is not sufficiently sanitized or constrained before being processed, allowing attacker-controlled data to influence execution paths. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Android platform specifically called out in the description, so desktop builds are not in scope of this particular Android-only WebAppInstalls path.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 - update Google Chrome on Android to 148.0.7778.216 or later via the Google Play Store, per the Stable channel update at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Where immediate patching is not feasible, the practical compensating controls are to instruct users not to open or install untrusted web app files in Chrome on Android, and to use MDM policy to block sideloading and restrict PWA installation prompts on managed devices; the trade-off is that legitimate PWA workflows will be blocked or degraded for end users. Network-level controls (blocking download of unknown file types via the corporate proxy/MDM) can reduce exposure but will not help on devices off the corporate network.