CVE-2026-13852: Improper Input Validation

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: High...

PT-2026-54133

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the Speech component allows a remote attacker who has already compromised the renderer process to perform privilege escalation b...

PT-2026-54187

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in WebXR allows a remote attacker to leak cross-origin data through a crafted HTML page. WebXR is an API that enables the creation of virtual...

PT-2026-54206

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in DevTools allows a local attacker to bypass navigation restrictions by using a malicious file. Recommendations Update Google Chrome on Andro...

PT-2026-54204

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the UI allows a local attacker to perform privilege escalation by using a malicious file. Recommendations Update Google Chrome o...

PT-2026-54389

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the WebAppInstalls component allows a local attacker to perform UI spoofing by using a malicious file. UI spoofing is a technique where an...

PT-2026-54309

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in WebXR allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. Recommendations Update Google Chrome on...

PT-2026-54219

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An uninitialized use in CSS allows a remote attacker to obtain potentially sensitive information from process memory by inducing the user to visit a crafted HTML page...

PT-2026-54103

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the Autofill feature allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved ...

PT-2026-54211

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in Dawn allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTM...

PT-2026-54240

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in the WebView component allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. Recommendations Update Googl...

PT-2026-54143

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An improper input implementation allows a remote attacker who has already compromised the renderer process to bypass site isolation by using a specially crafted HTML page. Si...

PT-2026-54281

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description A use after free issue exists in the Omnibox, where a remote attacker could potentially exploit heap corruption through a crafted HTML page. This requires the attacker to...

PT-2026-54065

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description A use after free issue exists in the Fullscreen component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption....

PT-2026-54321

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in CustomTabs allows a remote attacker to bypass the same origin policy, which is a security mechanism that restricts how a document or script...

PT-2026-54099

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the Extensions component allows an attacker to bypass the same origin policy—a security mechanism that restricts how a document or script...

Google Android Configuration Error Vulnerability

Google Android is an open-source operating system based on Linux, developed by Google Inc. Google Android has a configuration vulnerability that stems from unsafe default values in the NfcDispatcher.java file. Attackers can exploit this vulnerability to gain local privileges...

PT-2026-54164

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the Near Field Communication NFC component allows a remote attacker who has already compromised the renderer process to leak cross-origin...

Google Android competition conditions issue vulnerability (CNVD-2026-26393)

Google Android is an open-source operating system based on Linux, developed by Google Inc. Google Android has a vulnerability known as a race condition. This vulnerability stems from a persistent synchronization issue within the createSessionInternal function in PackageInstallerService.java...

PT-2026-54230

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in XML allows a remote attacker to obtain potentially sensitive information from process memory by inducing the user to visit a crafted HTML...