This vulnerability (CVE-2026-13851) in Google Chrome on Android arises from insufficient validation of untrusted input within the WebAppInstalls feature. Exploiting this flaw, a local attacker can bypass discretionary access control mechanisms by delivering a specially crafted HTML page. The issue affects Chrome versions before 150.0.7871.47. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. No official remediation level or patch link is explicitly stated in the provided data, though a vendor advisory URL is given for further details.

Successful exploitation allows a local attacker to bypass discretionary access control, potentially leading to unauthorized actions that compromise the integrity and availability of the affected system. There is no confidentiality impact reported. The vulnerability does not require privileges or user interaction to exploit, increasing its risk. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Since no explicit patch or remediation level is provided, users and administrators should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed fixed. Until then, exercise caution with untrusted HTML content on affected Chrome versions.