CVE-2026-13851: Google Chrome Auth Bypass Vulnerability

CVE-2026-13851 Overview

CVE-2026-13851 is an input validation vulnerability [CWE-20] in the WebAppInstalls component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to properly validate untrusted input, allowing a local attacker to bypass discretionary access control through a crafted HTML page. Google's Chromium team rates the underlying security severity as High. The National Vulnerability Database assigns a CVSS 3.1 base score of 9.1, reflecting high impact on integrity and availability. The flaw affects Chrome installations on the Android operating system and was addressed in the Chrome Stable channel update.

Critical Impact
A crafted HTML page can bypass Android discretionary access controls through the Chrome WebAppInstalls component, enabling unauthorized modification of protected resources.

Affected Products

Google Chrome on Android versions prior to 150.0.7871.47
Google Android (as the host operating system for the vulnerable Chrome builds)
Chrome-based web application install workflows using the WebAppInstalls component

Discovery Timeline

2026-06-30 - CVE-2026-13851 published to the National Vulnerability Database
2026-07-02 - Last updated in the NVD database

Technical Details for CVE-2026-13851

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls component of Chrome on Android. This component handles the installation of Progressive Web Applications (PWAs) and manages metadata such as manifest files, icons, and scope declarations. Chrome fails to enforce sufficient validation on untrusted input processed during the install workflow.

An attacker delivers a crafted HTML page that triggers the flawed install path. The malformed input allows the attacker to circumvent Android's discretionary access control (DAC) boundaries that normally isolate applications and their storage. The impact profile shows no confidentiality loss but high integrity and availability impact, indicating the flaw permits unauthorized writes or state changes rather than data exfiltration.

Root Cause

The root cause is improper input validation [CWE-20] within the WebAppInstalls handling logic. Chrome accepts fields from the web app manifest or install request without sufficient sanitization or bounds checks. The invalid input propagates into privileged operations that touch resources normally protected by Android's per-app sandbox.

Attack Vector

The CVSS vector lists a network attack vector because the malicious HTML page is delivered over the web. However, exploitation depends on the target visiting the crafted page in a vulnerable Chrome build on Android. Once the page loads, it invokes the WebAppInstalls flow with attacker-controlled parameters. The resulting DAC bypass lets the attacker alter files or application state that Android policy would normally protect from the browser process.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry for additional technical context as the vendor releases details.

Detection Methods for CVE-2026-13851

Indicators of Compromise

Chrome for Android instances reporting a version string earlier than 150.0.7871.47 in mobile device management (MDM) or endpoint inventory data
Unexpected PWA installations or modifications to web app shortcuts on Android devices without user initiation
Anomalous file writes or state changes attributable to the Chrome package in Android application logs

Detection Strategies

Query MDM and unified endpoint management (UEM) inventories for Chrome Android build numbers below 150.0.7871.47
Correlate mobile browsing telemetry with newly registered web apps or manifest installs occurring outside expected user behavior
Inspect Android logcat and application sandbox integrity data for writes originating from the Chrome process to resources outside its normal scope

Monitoring Recommendations

Monitor network egress from mobile fleets for repeated visits to unknown domains hosting HTML pages that invoke beforeinstallprompt or web app manifest APIs
Track Chrome release channel status through the Google Chrome Stable Update advisory
Alert on Android devices where automatic Chrome updates are disabled or delayed beyond policy thresholds

How to Mitigate CVE-2026-13851

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Enforce automatic app updates on managed Android devices via MDM policy
Audit the fleet for out-of-date Chrome installations and prioritize remediation on devices handling sensitive workloads

Patch Information

Google released the fix in the Chrome Stable channel. Users should upgrade to Chrome for Android 150.0.7871.47 or later. Details are available in the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry.

Workarounds

Restrict use of vulnerable Chrome versions on Android through conditional access policies until patching is complete
Advise users to avoid installing web apps or accepting install prompts from untrusted sites
Use an alternate, up-to-date browser on Android for high-risk browsing until the Chrome update is deployed

bash

# Verify Chrome for Android version via adb on a managed device
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 150.0.7871.47 or later
# versionName=150.0.7871.47