This vulnerability arises from insufficient validation of untrusted input within the WebAppInstalls feature of Google Chrome on Android versions before 148.0.7778.216. A local attacker could exploit this flaw by providing a malicious file, resulting in arbitrary code execution. The issue was publicly disclosed on May 28, 2026, with a vendor advisory linked but without explicit patch or remediation information. The affected product is not a cloud service, so remediation depends on user-side updates.

Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code on the affected device, potentially leading to unauthorized actions or compromise of the device. However, no known exploits in the wild have been reported, and the exact impact depends on attacker access and conditions.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users should update Google Chrome on Android to version 148.0.7778.216 or later once available. Until then, limiting local attacker access to the device may reduce risk.