PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9987 Google CVE debrief

A high-severity local code execution vulnerability in Google Chrome on Android, stemming from insufficient validation of untrusted input in the WebAppInstalls component. A local attacker can exploit this by tricking a user into processing a malicious file, resulting in arbitrary code execution with elevated privileges. The Chromium security team rates this severity as High. The issue is resolved in Chrome for Android version 148.0.7778.216 and later.

Vendor
Google
Product
Chrome
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with Android device fleets, mobile security teams, Chrome enterprise administrators, and end users who install web applications on Android devices.

Technical summary

The vulnerability resides in the WebAppInstalls component of Google Chrome on Android, where untrusted input is not properly validated. A local attacker can leverage a malicious file to trigger arbitrary code execution. The attack requires user interaction but no privileges, and results in complete confidentiality, integrity, and availability impact on the affected device. The fix is included in Chrome stable version 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Android to version 148.0.7778.216 or later as soon as possible.
  • Restrict installation of web apps from untrusted sources and educate users to avoid opening unexpected files.
  • Monitor for anomalous local process behavior on managed Android devices running Chrome.
  • Apply enterprise mobile device management (MDM) policies to enforce browser update compliance.

Evidence notes

The NVD record and Chrome release advisory confirm the vulnerability exists in Chrome on Android versions prior to 148.0.7778.216. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) supports the 7.8 score with local attack vector, no privileges required, but user interaction needed. The Chromium issue tracker reference is marked Permissions Required, indicating restricted access to technical details. CPE data confirms the affected product as Google Chrome and notes Android as the target platform.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9987 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9987

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9987 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9987

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.