CVE-2026-13927: Chrome Android Privilege Escalation via Malicious File – HIGH Risk

Technical summary

CVE-2026-13927 is a CWE-20 (Improper Input Validation) vulnerability affecting Google Chrome on Android versions prior to 150.0.7871.47. The vulnerability stems from insufficient validation of untrusted input processed by the Chrome UI layer. An attacker with local access can craft a malicious file that, when opened or processed by the user through Chrome's interface, bypasses validation checks and triggers privilege escalation. The attack vector is local (AV:L), requires no special privileges to initiate (PR:N), but does require user interaction (UI:R) to activate the malicious file.

Business impact

This vulnerability poses a significant risk to Android users running Chrome, particularly in environments where device security is critical. Successful exploitation allows an attacker to elevate privileges to system level or beyond the user's intended permission scope, potentially enabling unauthorized access to sensitive data, installation of persistent malware, manipulation of system settings, or lateral movement to other applications and services on the device. Organizations managing Android devices through enterprise mobility management (EMM) solutions should treat this as a priority given the prevalence of Chrome usage.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. This impacts all Android devices—phones, tablets, and foldable devices—running vulnerable Chrome versions. The vulnerability does not affect Chrome on other platforms (Windows, macOS, Linux, iOS) based on the vulnerability specification, though Chrome on those platforms should be updated to the latest available version as standard practice.

Exploitability

Exploitability is constrained by the requirement for local access and user interaction. An attacker must place a malicious file on the target device (via USB, malicious app, compromised website download, or physical access) and then socially engineer or trick the user into opening it through Chrome. The CVSS vector indicates low attack complexity (AC:L), meaning once the user interaction occurs, exploitation is reliable. However, the practical barrier remains the need to compromise the device environment and user behavior—not a remote, zero-interaction attack. As of the provided data, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited active exploitation in the wild at publication, though this can change rapidly.

Remediation

Users should update Google Chrome on Android to version 150.0.7871.47 or later as soon as possible. Organizations should enforce this update through their EMM platforms, Mobile Device Management (MDM), or Google Play Managed Deployment policies. For organizations unable to immediately patch, consider restricting Chrome permissions within the MDM profile, disabling file download functionality if not required, or directing users to avoid opening files from untrusted sources in Chrome until patching is complete.

Patch guidance

Google has released Chrome version 150.0.7871.47 for Android as the remediation. Users can manually check for updates via Chrome Settings > About Chrome, which will automatically check for and install available updates. Enterprise administrators should verify the availability of this version in their deployment channels and configure mandatory or recommended update policies. Verify the exact patch version against Google's official Chrome release notes to confirm deployment of the correct build.

Detection guidance

Monitor for failed privilege escalation attempts in system logs or SELinux audit logs on Android devices running Chrome. Endpoint detection and response (EDR) solutions with Android support should alert on unexpected privilege escalation activity tied to Chrome process execution. Organizations can also monitor Chrome update deployment status through MDM consoles to identify devices still running versions prior to 150.0.7871.47. Forensic indicators include the presence of suspicious files in device storage that were accessed by Chrome around the time of privilege escalation attempts.

Why prioritize this

This vulnerability merits high priority remediation despite not being actively exploited (KEV=false) because: (1) it enables local privilege escalation with high impact (complete system compromise potential); (2) Chrome is ubiquitously installed on Android devices, creating massive exposure; (3) the attack requires only user interaction, not special privileges, making it accessible to common threat actors; (4) the CVSS score of 7.8 (HIGH) reflects the combination of high confidentiality, integrity, and availability impact; and (5) Android is a primary attack surface for mobile-focused threat actors. Early patching reduces the window for exploitation before active malware campaigns emerge.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH severity) reflects: Local attack vector (AV:L) limiting remote attacks; Low attack complexity (AC:L) indicating reliable exploitation once triggered; No privileges required (PR:N) allowing any local user to attempt exploitation; Required user interaction (UI:R) as the mitigating factor preventing fully autonomous attacks; and High impact across confidentiality, integrity, and availability (C:H, I:H, A:H), indicating complete system compromise is possible. The score appropriately weights this as a serious local escalation threat requiring immediate attention despite the user interaction requirement.

Frequently asked questions