CVE-2026-13872: Chrome Android Sandbox Escape Vulnerability

CVE-2026-13872 Overview

CVE-2026-13872 is an input validation vulnerability in the WebAppInstalls component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to properly validate untrusted input supplied through malicious files. A local attacker can leverage this weakness to escape the Chrome sandbox on Android devices. The issue is tracked under CWE-20: Improper Input Validation and Chromium classifies its internal severity as Medium, while NVD scores it higher due to broader integrity and availability impact.

Critical Impact
A successful sandbox escape allows attacker-controlled code to break out of Chrome's isolation boundary on Android, enabling access to resources the browser process should not reach.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based Android browsers sharing the affected WebAppInstalls code path
Downstream distributions bundling vulnerable Chrome for Android builds

Discovery Timeline

2026-06-30 - CVE-2026-13872 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13872

Vulnerability Analysis

The flaw resides in the WebAppInstalls subsystem of Chrome for Android, which handles installation flows for Progressive Web Apps and related web-app metadata. The component accepts data sourced from files supplied by the user or another local application. Insufficient validation of that untrusted input creates a path for an attacker to influence execution beyond the renderer sandbox boundary.

Because the attack requires a local malicious file, exploitation depends on delivering that file to the target device through a companion app, download, or shared storage. Once processed by WebAppInstalls, the malformed input drives Chrome logic in ways the sandbox model does not anticipate.

The outcome is a sandbox escape rather than direct code execution in the renderer. An attacker gains access to APIs and resources normally reserved for higher-privileged browser components. This class of Android Chrome escape is frequently paired with a renderer exploit to build a full compromise chain.

Root Cause

The root cause is improper input validation ([CWE-20]) in the file-parsing path of WebAppInstalls. Fields extracted from an attacker-controlled file are consumed without adequate sanity checks on type, size, or structural constraints before being used by trusted browser code.

Attack Vector

Exploitation requires a local attacker to place a malicious file where Chrome's WebAppInstalls handler will parse it. The vulnerability does not require authentication or user interaction with a prompt, but does require the file to reach the affected code path. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Blog for vendor detail.

// No verified public proof-of-concept is available for CVE-2026-13872.
// Technical specifics remain restricted in the Chromium issue tracker.

Detection Methods for CVE-2026-13872

Indicators of Compromise

Chrome for Android builds reporting a version string earlier than 150.0.7871.47 on managed devices
Unexpected Progressive Web App installation events or WebAppInstalls activity triggered by other local apps
Suspicious files with web-app manifest or install-payload structures written to Chrome-accessible storage paths

Detection Strategies

Inventory Android endpoints and flag Chrome installations below the fixed version 150.0.7871.47
Monitor Android application logs for WebAppInstalls invocations correlated with recently dropped files
Correlate mobile threat telemetry with sideloaded application installs that immediately interact with Chrome

Monitoring Recommendations

Enforce Chrome version reporting through mobile device management (MDM) and alert on stale versions
Track file writes into Chrome's external cache and download directories from non-browser processes
Review Google Play Protect and mobile EDR alerts for local privilege boundary violations on Chrome processes

How to Mitigate CVE-2026-13872

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Push the updated Chrome build to managed devices via MDM and verify deployment status
Restrict sideloading of untrusted Android applications that could plant malicious WebAppInstalls files

Patch Information

Google addressed the issue in Chrome for Android 150.0.7871.47. Details are published in the Google Chrome Update Blog, with the underlying bug tracked in the Chromium Issue Tracker Entry. Apply the vendor update rather than relying on configuration changes.

Workarounds

Disable Progressive Web App installation prompts through enterprise Chrome policy where feasible
Limit which local applications can share files with Chrome using Android per-app storage controls
Educate users to avoid opening unknown files with Chrome until the patched build is installed

bash

# Verify the installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output on patched devices:
# versionName=150.0.7871.47