Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the way the browser handles web application installations could allow a remote attacker to execute malicious code on a user's Windows computer. To succeed, an attacker would need to trick a user into visiting a malicious website and performing specific interactions or gestures within the browser interface. Successful exploitation could lead to a full system compromise, unauthorized data access, or the installation of malware.
Technical details
A vulnerability classified as improper input validation (CWE-20) exists in the WebAppInstalls component of Google Chrome for Windows. The flaw stems from insufficient validation of untrusted input during the web app installation process. A remote, unauthenticated attacker can exploit this by hosting a specially crafted HTML page and enticing a user to perform specific UI gestures. Successful exploitation allows for arbitrary code execution within the context of the browser. Google has addressed this issue in version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-16: disclosed: Reported by Daniel Rodríguez
- 2026-06-30: patched: Fixed in Chrome version 150.0.7871.47
- 2026-06-30: advisory