This vulnerability involves insufficient validation of untrusted input in the WebAppInstalls feature of Google Chrome on Android versions before 150.0.7871.115. It enables a local attacker to bypass the same origin policy by using a specially crafted HTML page. The CVSS vector indicates the attack requires local access, low complexity, no privileges, and user interaction, resulting in limited confidentiality impact without integrity or availability effects. The vendor advisory link is provided but does not explicitly confirm a patch or remediation status.

The impact is limited to a local attacker bypassing the same origin policy, potentially allowing limited unauthorized access to data within the browser context. The confidentiality impact is low, with no impact on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted local content and avoid opening suspicious HTML pages.