CVE-2026-13794: Google Chrome RCE Vulnerability

CVE-2026-13794 Overview

CVE-2026-13794 is an input validation vulnerability in the WebAppInstalls component of Google Chrome on Windows. Versions prior to 150.0.7871.47 fail to properly validate untrusted input during web app installation flows. A remote attacker who convinces a user to perform specific UI gestures on a crafted HTML page can execute arbitrary code on the target system. The flaw is tracked under [CWE-20: Improper Input Validation] and rated High by the Chromium security team. Exploitation requires user interaction, which raises attack complexity, but successful abuse yields full code execution in the browser context on Windows endpoints.

Critical Impact
Remote arbitrary code execution on Windows systems running vulnerable Chrome builds, achievable through a crafted HTML page combined with specific user interactions.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows platforms running the vulnerable Chrome build
Chromium-derived browsers on Windows that share the WebAppInstalls implementation

Discovery Timeline

2026-06-30 - CVE-2026-13794 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13794

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem of Google Chrome, which handles Progressive Web App (PWA) installation prompts and related install flows. The component does not sufficiently validate untrusted input received from web content. Attackers craft HTML pages that supply malformed or unexpected data to the install pipeline. When the user performs a specific UI gesture, such as accepting an install prompt or interacting with the install surface, the browser processes the attacker-controlled data along a code path that permits arbitrary code execution. The Chromium project classifies the severity as High. The EPSS model estimates a low near-term exploitation probability, but successful attacks fully compromise the browser process context.

Root Cause

The root cause is improper validation of untrusted input passed to the WebAppInstalls handler [CWE-20]. Fields associated with the web app install manifest or install invocation are not sanitized or bounds-checked before being consumed by browser code. This allows attacker-controlled values to steer execution into unsafe states during the install ceremony.

Attack Vector

The attack requires the victim to visit an attacker-controlled or compromised web page. The page must trigger a specific UI gesture sequence, typically involving the web app install prompt. Once the gesture is completed, the crafted payload is processed by the vulnerable code path. The vector is network-based and does not require prior authentication, but it depends on social engineering to elicit the required user interaction.

No public proof-of-concept has been released. Technical details are limited to the Google Chrome Update Announcement and the restricted Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13794

Indicators of Compromise

Chrome browser processes on Windows spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after a user visits an untrusted site
Unexpected web app install entries created under the Chrome user profile without administrator awareness
Outbound network connections from chrome.exe to newly registered or low-reputation domains hosting install manifests

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any Windows endpoint running a build earlier than 150.0.7871.47
Hunt for anomalous process lineage where chrome.exe is the parent of scripting or LOLBin executables
Correlate browser telemetry with EDR events showing file writes to the Chrome web app install directories following a browsing session

Monitoring Recommendations

Enable browser security event forwarding to a centralized SIEM to capture install prompt activity and extension changes
Monitor Windows Application and Security event logs for unexpected shortcut creation tied to Chrome web app installs
Alert on Chrome update failures that leave endpoints on vulnerable builds beyond a defined patch SLA

How to Mitigate CVE-2026-13794

Immediate Actions Required

Update Google Chrome on Windows to version 150.0.7871.47 or later on every managed endpoint
Force a browser restart after the update to ensure the patched binaries are loaded
Audit Chrome update policies to confirm automatic updates are enabled and not blocked by group policy

Patch Information

Google released the fix in the Chrome Stable channel update announced on 2026-06-30. Administrators should deploy Chrome 150.0.7871.47 or newer. Refer to the Google Chrome Update Announcement for the full advisory and to the Chromium Issue Tracker Entry for the tracking record.

Workarounds

Disable web app installation via enterprise policy by setting WebAppInstallForceList and related install policies to restrict install sources until patching completes
Train users to decline install prompts originating from unfamiliar or untrusted websites
Restrict browsing to trusted sites through URL filtering while patch rollout is in progress

bash

# Configuration example: Chrome enterprise policy to block web app installs on Windows
# Registry path: HKLM\SOFTWARE\Policies\Google\Chrome
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebAppInstallForceList /t REG_SZ /d "[]" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultWebAppInstallSetting /t REG_DWORD /d 2 /f