What is the CVSS score of EUVD-2026-42486?

EUVD-2026-42486 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-42486?

Yes, a patch is available for EUVD-2026-42486. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-42486

| CVE-2026-15115 LOW

Improper Input Validation (CWE-20)

2026-07-08 chrome-cve-admin@google.com

GHSA-hfq2-wc27-2rmq

Authentication Bypass Google

3.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

AV:L and UI:R confirmed by description; C:L reflects partial SOP bypass; no integrity or availability impact stated.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:13 vuln.today

CVSS changed

Jul 09, 2026 - 11:22 NVD

3.3 (LOW)

CVE Published

Jul 08, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebAppInstalls component on Android exposes limited cross-origin data to a local attacker who can direct a user to visit a crafted HTML page. All Chrome for Android releases prior to 150.0.7871.115 are affected. Google has rated this High severity internally despite a CVSS base score of 3.3 (Low); no public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Technical ContextAI

The vulnerability resides in the WebAppInstalls subsystem of Chrome on Android - the component responsible for handling Progressive Web App (PWA) installation flows and related browser-managed web application lifecycle events. CWE-20 (Improper Input Validation) is the root cause class, meaning Chrome fails to adequately validate untrusted input (likely origin or URL data) submitted during the install flow, allowing a crafted HTML page to influence security-sensitive decisions that should be gated by the same-origin policy. The same-origin policy (SOP) is a foundational browser security boundary that prevents scripts from one origin from accessing data on another origin; bypassing it - even partially - can expose cookies, DOM content, or response data from protected origins. The CPE-equivalent affected product is Google Chrome for Android versions below 150.0.7871.115, as confirmed by the EUVD version range 'Chrome 150.0.7871.115 <150.0.7871.115'.

RemediationAI

The primary remediation is updating Chrome for Android to version 150.0.7871.115 or later, which resolves the insufficient input validation in WebAppInstalls. The patch is confirmed available per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Enterprise administrators managing Android device fleets via MDM should push this Chrome update as a priority. As a compensating control where immediate update is not feasible, restricting access to untrusted web content via Chrome's managed browser policies (e.g., URL blocklisting) reduces exposure, though this does not address the underlying flaw. Disabling PWA installation via Chrome enterprise policy (WebAppInstallForceList and related policies) may limit the attack surface in the WebAppInstalls component specifically, but has the operational trade-off of disabling legitimate PWA functionality. There is no indication that other browsers on Android are affected by this specific vulnerability.