Executive brief
A vulnerability in Google Chrome's web application installation component could allow a remote attacker to execute unauthorized code. By tricking a user into visiting a specially crafted website, an attacker could run commands within the browser's restricted security environment. While the impact is limited by the browser's sandbox, it represents a failure in how the browser handles untrusted data during app installation.
Technical details
An improper input validation vulnerability (CWE-20) exists in the WebAppInstalls component of Google Chrome. The flaw is triggered when the browser processes untrusted input during the installation of web applications. A remote attacker can exploit this by hosting a malicious HTML page; if a user navigates to this page, the attacker can achieve arbitrary code execution within the confines of the Chromium sandbox. The vulnerability was addressed in Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory