Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Google Chrome Android Sandbox Escape via Malicious File

CVE-2026-13872 · published 4 months ago
Summary

A security issue in older versions of Google Chrome on Android allows a local attacker to potentially break out of the browser's security sandbox. This could allow the attacker to access sensitive information or take control of the device. Users should update to the latest version of Google Chrome to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian chromium All versions
Debian:12 debian chromium All versions
Debian:13 debian chromium All versions
Debian:14 debian chromium All versions
Original advisory text
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file...
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published30 Jun 2026
Updated3 Nov 2026
First seen1 Jul 2026
Sources
DEBIAN-CVE-2026-13872 · OSV
CVE-2026-13872 · NVD
Track software like this
Free during beta