EUVD-2026-93853
GHSA-crh8-f9hq-22vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted HTML to Chrome Android
-
ExploitTrigger incorrect authorization in WebAppInstalls
-
ExecutionBypass system access restrictions
-
ImpactAccess restricted resources across scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running Chrome for Android at a version prior to 155.0.8059.39 and to actively load an attacker-crafted HTML page (UI:R) that exercises the WebAppInstalls (web app installation) flow; the flaw is an incorrect authorization check in that specific feature, which permits bypassing system access restrictions. No authentication is required (PR:N) and no special server-side configuration is named, but the dependence on user interaction (visiting/interacting with the malicious page) and the Android-specific WebAppInstalls code path are the primary factors limiting real-world exploitation. Desktop Chrome is not clearly in scope based on the description. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a network-reachable, low-complexity, unauthenticated flaw, but one that is gated by user interaction (UI:R) and limited to Low confidentiality and Low integrity impact with a changed scope - consistent with a browser sandbox/permission bypass rather than full code execution. Chromium itself rated this Medium severity. Exploitation signals are weak-to-absent: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The combination of low EPSS, no KEV, and only partial (L/L/N) impact argues this is a high-reach-but-low-real-risk issue rather than an actively exploited priority. One data caveat: the description explicitly scopes this to 'Google Chrome on Android,' yet the affected CPE is the generic cpe:2.3:a:google:chrome:*:* with no Android platform qualifier - verify the platform scope against the vendor advisory, as desktop Chrome may not be affected. |
| Exploit ScenarioDerived | A victim using Chrome for Android (prior to 155.0.8059.39) is lured into visiting an attacker-controlled web page. The crafted HTML abuses the WebAppInstalls flow's incorrect authorization check to bypass system access restrictions, letting the remote attacker reach resources or capabilities the browser should have blocked. No public exploit code is referenced, and successful exploitation requires the user to load the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Incorrect authorization in the WebAppInstalls component of Google Chrome for Android before 155.0.8059.39 lets a remote, unauthenticated attacker bypass Android system access restrictions when a victim loads a crafted HTML page. Rated CVSS v3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and Chromium security severity Medium, the issue is a genuine but moderate-priority logic flaw rather than an emergency: EPSS is only 0.19% (8th percentile), no public exploit identified at time of analysis, and it is not in CISA KEV, with the Android-specific WebAppInstalls code path and mandatory user interaction being the main factors limiting real-world exploitation. Vendor-released patch: Chrome 155.0.8059.39.
RemediationAI
Upgrade Chrome for Android to 155.0.8059.39 or later, which is the fixed release identified by the vendor advisory and reflected in the Chrome stable channel update; Chrome self-updates through Google Play, but managed fleets should push the update through EMM/MDM or Play-managed updates and verify the installed version, since users on older builds remain exposed until the upgrade lands. Enterprise and consumer admins who cannot patch immediately can reduce exposure by restricting the browser build accepted on managed Android devices and by controlling web app installation behavior through available Chrome enterprise policies and content settings, accepting the trade-off that restricting or disabling web app install prompts and related PWA/WebAPK functionality degrades legitimate use of installable web apps. Additional compensating controls include keeping untrusted browsing confined away from user accounts that have elevated device entitlements and monitoring for unexpected web app or shortcut creation, while noting that these measures do not remove the underlying authorization flaw and are only stopgaps. Patch status per available data is patch available from vendor (Chrome 155.0.8059.39); advisory references are https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and https://issues.chromium.org/issues/501171258, with EPSS at 0.19% (8th percentile) supporting a routine rather than emergency remediation cadence and no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization) inside WebAppInstalls, the Chrome for Android subsystem that handles installation of web apps and Progressive Web Apps (via WebAPK/shortcut creation) and interacts with Android's package-install and permission infrastructure. Because the flaw is a missing or wrong authorization check rather than a memory-safety bug, exploitation is a logic bypass enabled by a crafted HTML page that drives the web app installation flow; the CVSS scope change (S:C) reflects that a successful bypass escapes the browser's own security boundary and affects Android system-level access restrictions, while limited confidentiality and integrity impact (C:L/I:L) reflects the constrained nature of what the install path can reach. The network vector with user interaction (AV:N/AC:L/UI:R) and no required privileges (PR:N) match the assessment that a victim merely has to visit or interact with an attacker-controlled page; desktop Chrome is not clearly in scope based on the description. The affected-product CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is an unversioned wildcard, so version scoping must come from the Chrome stable channel advisory and the EUVD record (EUVD-2026-93853, whose affected-version string appears malformed), plus the upstream Chromium issue 501171258.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Remote crafted page with no auth gives AV:N/AC:L/PR:N, but requires the victim to load it (UI:R); the authorization bypass crosses the browser security boundary (S:C) with limited C/I impact and no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB