The vulnerability CVE-2026-13852 arises from insufficient validation of untrusted input within the WebAppInstalls feature of Google Chrome on Android. This weakness permits a local attacker to bypass discretionary access control mechanisms by crafting a malicious HTML page. The affected version is specifically identified as version 150.0.7871.47, implying versions before this are vulnerable. The Chromium security team rates this vulnerability as high severity. No CVSS score or detailed vendor remediation status is provided in the available data. The vendor advisory link is given but does not explicitly confirm patch availability or mitigation steps.

Successful exploitation of this vulnerability enables a local attacker to bypass discretionary access control protections on affected Chrome versions on Android. This could lead to unauthorized actions or access within the browser context. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted HTML content and restrict local access to the device where possible.