CVE-2026-13872 is a critical security vulnerability in Google Chrome on Android affecting versions before 150.0.7871.47. The issue stems from insufficient validation of untrusted input within the WebAppInstalls feature, which could enable a local attacker to perform a sandbox escape via a crafted malicious file. The vulnerability is tracked under CWE-20 (Improper Input Validation) and carries a CVSS v3.1 base score of 9.1, indicating high impact on integrity and availability without requiring privileges or user interaction. Although a vendor advisory URL is provided, it does not explicitly state the availability of a patch or official remediation.

Successful exploitation could allow a local attacker to escape the Chrome sandbox on Android devices, potentially leading to unauthorized code execution or compromise of the device's security boundaries. The vulnerability impacts the integrity and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided vendor advisory link should be monitored for updates regarding an official fix. Until a patch is confirmed, avoid executing untrusted files and limit local access to trusted users only.