CVE-2026-13794: Chrome WebAppInstalls Code Execution – Patch Now

Technical summary

CVE-2026-13794 is a CWE-20 (improper input validation) vulnerability in the WebAppInstalls component of Google Chrome for Windows versions prior to 150.0.7871.47. The flaw allows insufficient sanitization of untrusted input during web app installation workflows. An unauthenticated remote attacker can exploit this by hosting a crafted HTML page that, combined with user-initiated UI gestures (such as confirming an app installation dialog), bypasses security boundaries and achieves arbitrary code execution in the Chrome process context. The Chromium security team rated this High severity.

Business impact

Exploitation could result in complete compromise of the affected user's system, including theft of sensitive data, installation of malware, credential harvesting, and lateral movement within corporate networks. Organizations with Windows-based Chrome deployments face exposure to targeted phishing campaigns that abuse the app installation flow. The requirement for user interaction slightly raises the bar for mass exploitation but does not eliminate risk in environments where social engineering is effective.

Affected systems

Google Chrome on Microsoft Windows versions prior to 150.0.7871.47 are affected. The vulnerability does not impact Chrome on macOS, Linux, or Android, nor does it affect other Chromium-based browsers unless they incorporate the vulnerable WebAppInstalls code path. Organizations should verify their Chrome version against the patched build number.

Exploitability

Exploitation requires convincing a user to visit a malicious website and interact with specific Chrome UI elements during the web app installation process. While this demands user engagement rather than being passively triggered, modern phishing techniques and social engineering can reliably achieve this precondition. The attack surface is broad—any website can host the exploit payload. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been formally documented, though this does not guarantee absence of attack activity.

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all Windows systems. This patch addresses the input validation flaw in WebAppInstalls. Users can verify their current version via Chrome menu > Help > About Google Chrome, which will auto-update if an older version is detected. For enterprise deployments, use Chrome policy enforcement to mandate the minimum version or enable automatic updates.

Patch guidance

Deploy Chrome 150.0.7871.47 or subsequent releases across your Windows fleet as a priority update. For organizations using Chrome Enterprise, configure the 'Minimum Chrome Version' policy (MinimumChromeVersion) to enforce the patched build. Test the patch in a controlled environment first to ensure compatibility with internal web apps and extensions. Monitor user reports of web app installation issues post-patch, as the validation tightening may affect legacy custom app installers.

Detection guidance

Monitor for unusual Chrome process behavior following web app installations, including unexpected spawning of child processes or file system modifications outside the standard user profile directory. Network-based detection can identify traffic to known malicious sites hosting exploit payloads, though the HTML itself may appear benign. Endpoint detection and response (EDR) solutions should flag Chrome process execution with suspicious command-line arguments or abnormal parent-child relationships. Consider hunting for users who have recently interacted with Chrome's app installation UI in your telemetry.

Why prioritize this

This vulnerability merits prompt remediation due to its high CVSS score (7.5), remote exploitation vector, and potential for severe impact (arbitrary code execution). Although user interaction is required, the attack surface is substantial and social engineering remains reliable. The absence from KEV indicates it has not yet become a widespread campaign vector, creating a window of opportunity to patch before active exploitation matures.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an attack vector requiring network access but not authentication, moderate attack complexity due to UI interaction requirements, and high confidentiality, integrity, and availability impact. The score appropriately balances the broad exposure of web-browsing users against the user-interaction prerequisite. In high-social-engineering environments or where Chrome users access untrusted content frequently, effective risk may trend higher.

Frequently asked questions