CVE-2026-13852: Google Chrome Auth Bypass Vulnerability

CVE-2026-13852 Overview

CVE-2026-13852 is an input validation vulnerability in the WebAppInstalls component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to properly validate untrusted input supplied through a crafted HTML page. A local attacker can leverage this weakness to bypass discretionary access control on the device. Chromium classifies the security severity as High, and the CVSS score of 9.1 reflects the potential for integrity and availability impact. The flaw is tracked under [CWE-20: Improper Input Validation].

Critical Impact
A local attacker can bypass Android discretionary access control by loading a crafted HTML page in Chrome, gaining unauthorized influence over web app installation flows on the device.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Google Android (host operating system for the affected Chrome client)
Chromium-based browsers that inherit the WebAppInstalls component behavior

Discovery Timeline

2026-06-30 - CVE-2026-13852 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13852

Vulnerability Analysis

The defect resides in the WebAppInstalls subsystem of Google Chrome on Android, which handles Progressive Web App (PWA) installation from web content. The component accepts input from HTML pages without sufficient validation before acting on it. An attacker who convinces the user to load a crafted HTML page can influence how Chrome interacts with the Android permission model. The result is a bypass of discretionary access control (DAC), the mechanism Android uses to gate what actions apps and their components may perform.

Exploitation does not require elevated privileges on the browser side, and the CWE-20 categorization confirms the root defect is missing or insufficient sanitization of attacker-controlled data. The impact is scoped to integrity and availability, meaning the attacker can alter state or disrupt operations that should be restricted, but the vulnerability is not documented as leaking confidential data directly.

Root Cause

The root cause is improper validation of untrusted input reaching the WebAppInstalls code path. Fields sourced from an HTML page are consumed by installation logic without adequate structural or semantic checks. Because that logic interfaces with Android access-control decisions, malformed input allows a local attacker to reach operations that DAC should otherwise block.

Attack Vector

The attacker delivers a crafted HTML page and induces the user to open it in a vulnerable Chrome build on Android. When Chrome processes install-related metadata from the page, the malformed input steers WebAppInstalls into performing actions outside its expected boundary. The vector requires no authentication and no additional user interaction beyond page load. Refer to the Chromium Issue Tracker Entry for the upstream discussion of the defect.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is approximately 0.27%.

Detection Methods for CVE-2026-13852

Indicators of Compromise

Chrome for Android clients running versions earlier than 150.0.7871.47 in enterprise inventory.
Unexpected web app or PWA install prompts and shortcuts appearing on managed Android devices.
Browser navigation logs showing devices loading unfamiliar HTML pages immediately followed by new home-screen entries.

Detection Strategies

Query mobile device management (MDM) inventory for the installed Chrome version and flag any build below 150.0.7871.47.
Correlate web proxy or DNS telemetry with newly registered PWAs on the device to identify install activity originating from untrusted origins.
Monitor Android PackageInstaller and web app manifest events for installations that were not initiated by a user action captured in UI telemetry.

Monitoring Recommendations

Enable enterprise reporting for Chrome on Android to centralize version, extension, and installed web app data.
Alert on Android devices where Chrome remains unpatched more than a defined SLA window after 150.0.7871.47 is available.
Track outbound traffic to newly observed domains that serve HTML with manifest.json and beforeinstallprompt handling for unusual patterns.

How to Mitigate CVE-2026-13852

Immediate Actions Required

Update Google Chrome on Android to 150.0.7871.47 or later on every managed device.
Push the update through MDM policy and confirm compliance rather than relying on user-initiated Play Store updates.
Restrict sideloading and non-Play Store distribution channels for Chrome on managed Android fleets.

Patch Information

Google addressed the flaw in the Chrome Stable channel update announced in the Google Chrome Desktop Update advisory, which corresponds to the Android build 150.0.7871.47. Upstream Chromium fix details are tracked in the Chromium Issue Tracker Entry. Apply the vendor-supplied update as the primary remediation.

Workarounds

Disable web app installation prompts through enterprise policy where feasible until patching is complete.
Instruct users to avoid opening untrusted links in Chrome on Android and prefer managed browsers with policy-enforced restrictions.
Use MDM controls to block installation of PWAs from unapproved origins on high-risk devices.

bash

# Example Chrome enterprise policy on Android to disable web app installs
# Deploy via your MDM as a Managed Configuration for com.android.chrome
{
  "WebAppInstallForceList": [],
  "DefaultWebAppInstallSetting": 2,
  "URLBlocklist": [
    "*"
  ],
  "URLAllowlist": [
    "https://corp.example.com/*"
  ]
}