This vulnerability in Google Chrome on Android arises from insufficient validation of untrusted input in the WebAppInstalls feature. An attacker can exploit this by crafting a malicious HTML page that bypasses discretionary access control mechanisms, potentially leading to unauthorized actions or disruption. The issue is tracked as CVE-2026-13852 with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The affected versions are those before 150.0.7871.47. No official remediation level or patch link is explicitly stated in the input, but a vendor advisory URL is provided for further details.

The vulnerability allows a local attacker to bypass discretionary access control in Google Chrome on Android, potentially leading to integrity and availability impacts. The CVSS vector indicates no confidentiality impact but high impact on integrity and availability. This could enable unauthorized modification or disruption of browser functionality via a crafted HTML page without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Since no explicit patch or remediation level is provided in the data, users should monitor official Google Chrome updates and apply the update to version 150.0.7871.47 or later once available.