CVE-2026-9987: Chrome Android WebAppInstalls Code Execution Vulnerability

Technical summary

CVE-2026-9987 is a local code execution vulnerability affecting Google Chrome's WebAppInstalls functionality on Android. The vulnerability exists due to insufficient validation of untrusted input in the Web App installation handler prior to version 148.0.7778.216. The flaw maps to CWE-20 (improper input validation) and allows a local attacker to execute arbitrary code with full app privileges by crafting a malicious file and inducing user interaction. Chrome's sandboxing on Android is bypassed only at the level of the WebAppInstalls process context.

Business impact

For organizations deploying Chrome on Android devices (BYOD, corporate-owned, or kiosk scenarios), this vulnerability creates a material risk. Compromised devices could serve as pivot points into internal networks if Chrome syncs sensitive data or authentication tokens. For app developers relying on Web App Install features via Chrome, malicious actors could abuse this to sideload malware or steal user credentials within the app's permission scope. The impact depends on what data and permissions are granted to Chrome on the affected device.

Affected systems

Google Chrome on Android versions prior to 148.0.7778.216 are affected. Desktop and iOS versions of Chrome are not impacted by this specific flaw. Android devices running affected Chrome versions are the sole target, regardless of Android version, provided Chrome is installed and used.

Exploitability

This vulnerability requires local access and user interaction, which moderately constrains exploitability. An attacker cannot remotely trigger code execution over the network. However, once a malicious file reaches a device (via email, messaging, download, or USB), the bar to trigger the vulnerability is relatively low—simply handling or installing a specially crafted web app is likely sufficient. The CVSS score of 7.8 (High) reflects this combination: low attack complexity and no privilege escalation needed, but local-only attack surface.

Remediation

Update Google Chrome on Android to version 148.0.7778.216 or later. Users should enable automatic app updates via the Google Play Store to ensure timely patching. Organizations with mobile device management (MDM) policies should enforce the Chrome version requirement and verify compliance across enrolled Android devices.

Patch guidance

Chrome on Android typically auto-updates through the Google Play Store. Verify that "Auto-update apps" is enabled in Play Store settings. Manual verification: open Chrome, navigate to Settings > About Chrome, and confirm the version is 148.0.7778.216 or later. For MDM-managed deployments, push the version requirement to all managed devices and monitor rollout status. No interim workarounds are available; patching is the only remediation.

Detection guidance

Monitor Chrome version deployments on Android devices via MDM telemetry or Play Store data. Look for suspicious Web App installation activity (native logs at /data/data/com.android.chrome/app_webapps/) correlated with unexpected code execution or file writes. On a forensic level, examine Chrome's cache and app data for malformed installation manifests or suspicious file origins. Behavioral detection is limited in scope without native endpoint monitoring; version compliance checks are the most practical detection method.

Why prioritize this

Although the vulnerability requires local access and user interaction, the combination of high severity (7.8 CVSS), full code execution, and Android's critical role in enterprise and consumer mobile ecosystems warrants rapid patching. The WebAppInstalls feature is frequently used for PWA and enterprise app distribution, making this a realistic attack vector in targeted scenarios. Prioritize patching devices with elevated risk (those syncing corporate credentials, payment data, or handling sensitive communications).

Risk score, explained

CVSS 7.8 High is driven by: (1) High impact across confidentiality, integrity, and availability; (2) Low attack complexity—no special conditions required; (3) No privilege escalation—attacker runs code in Chrome's context; (4) Local attack vector and required user interaction prevent a Critical rating. Organizations should treat this as HIGH priority due to the mobile device's trusted position in network access and data handling.

Frequently asked questions