Google has released Chrome for Android version 150.0.7871.47, patching a high-severity vulnerability that could allow a local attacker to sidestep the operating system's access controls using a specially crafted HTML page. The flaw, tracked as CVE-2026-13852, affects all versions of Chrome for Android prior to this update. Everyone who uses Chrome on an Android device should download the update immediately.
What the Update Fixes
CVE-2026-13852 is a bug in the way Chrome for Android handles web content that enables a bypass of discretionary access control (DAC). DAC is a core security mechanism in Android that dictates how files, hardware, and system services can be accessed by applications and processes. When it works correctly, web pages rendered in Chrome are tightly sandboxed—they cannot reach into other parts of the device without explicit permission.
This flaw broke that barrier. According to Google's advisory, a local attacker could engineer a malicious HTML page that, when viewed in an unpatched version of Chrome, would silently bypass those access controls. The exact nature of what an attacker could achieve isn't fully detailed, but bypassing DAC typically means the ability to read files or interact with system components that should be off-limits—potentially including sensitive personal data, app caches, or even hardware sensors.
The attack requires local access, which in this context means the attacker must convince the user to open the crafted HTML content. That could come via a link in a text message, an email, a push notification from a compromised app, or even a redirect from an otherwise legitimate website. It is not a remote code execution bug that can be triggered without any user interaction.
Chrome for Android version 150.0.7871.47 includes the fix. Google did not disclose the technical details of the vulnerability, sticking to its typical practice of withholding deep write-ups until a majority of users have updated. The company did not assign a CVSS score publicly, but the "high" severity rating means the flaw posed a significant risk if left unpatched.
What It Means for You
For Everyday Android Users
If you use Chrome as your default browser, your device is vulnerable until you install this update. You do not need to be doing anything unusual—simply visiting a website or tapping a link from an untrusted source could be enough to trigger the flaw. The risk is elevated if you frequently open links from messaging apps or social media without thinking twice.
Google Chrome for Android updates are delivered through the Play Store, and they roll out gradually. Some users may already have the update waiting; others might need to check manually. We explain how in the "What to Do Now" section below.
There is a second, often overlooked, component: Android System WebView. This is the system-level engine that powers in-app browsers and web-rendering inside other applications. WebView is based on Chromium, and while it is updated separately, many security fixes for Chrome also apply to WebView. CVE-2026-13852 could potentially affect WebView as well—if a malicious page is opened inside an app that uses an unpatched WebView, the same access-control bypass might be exploited. Typical examples include feed readers, email clients that preview web content, or apps that authenticate via a browser window.
For IT Administrators
Fleet managers who oversee corporate Android devices must ensure that Chrome is updated on every managed phone and tablet. This is especially critical for employees who handle sensitive company data or have access to internal networks. Many enterprise mobility management (EMM) platforms can push app updates or enforce minimum version policies. If your organization uses Android Enterprise, you can restrict access to corporate resources until the device reports the correct Chrome version.
Also, verify that Android System WebView is updated, as it is often a separate package. Some organizations disable automatic updates for stability; if that is the case, WebView might lag behind. A vulnerable WebView could be exploited through any app that displays web content, even if the main Chrome browser is patched.
For Developers
If you maintain an Android app that loads web content via WebView, users running outdated devices or with automatic updates disabled may still be exposing your app to this bug. While you cannot force users to update their device components, you can take defensive measures: implement strict content security policies, avoid loading untrusted third-party web pages in your WebView instance, and consider prompting users to update their browser and WebView if a known vulnerability is detected.
Additionally, test your app's WebView usage against Chrome's updated behavior. Occasionally, security fixes alter how certain APIs work, which could break functionality if your app relied on the pre-patch behavior. There is no indication that this particular change introduces breaking changes, but it is good practice.
How We Got Here
Chrome for Android operates on a six-week major release cycle, with security patches sometimes pushed more rapidly for critical bugs. This latest update is part of the Chrome 150 series, which began rolling out in early 2026. The previous stable channel version was 149.x; users who have not yet received 150 will transition directly to the fixed build.
Google discovered CVE-2026-13852 through its internal security processes or through a report by an external researcher under the Chrome Vulnerability Reward Program. The company often credits researchers after the update has been widely adopted, but for now the advisory simply notes an unnamed party reported the flaw. The CVE record itself was reserved in late 2025 and went public with the release of the patch.
Access control bypass flaws in Android's web rendering components have appeared before. For instance, in 2025, a similar-sounding bug (CVE-2025-21134) allowed a local attacker to bypass the popup blocker and gain access to otherwise restricted browser resources. The WebView/Web platform is a complex attack surface, and Google's security team regularly fends off attempts to break out of the sandbox.
Discretionary access control is a foundational piece of Android's security model. Each app runs in its own sandbox, with a unique user ID, and permissions dictate what it can access. When a web page renders in Chrome, it is subject to an even stricter sandbox, mediated by Chrome's renderer processes. To bypass DAC means a web page could potentially read files from another app's private storage, access the device's camera or microphone without a permission prompt, or cross-contaminate other running processes. In short, it is a serious breach of the trust model that keeps your personal data safe from malicious websites.
The fact that this vulnerability is classified as "local" might sound less scary than a remote code execution hole, but for an attacker who can craft a convincing phishing attack, the barrier is low. A well-timed text message with a link that spoofs a legitimate service could easily prompt a user to open a page that triggers the bug.
What to Do Now
The fix is simple, but you must be proactive. Here are the steps:
-
Update Chrome for Android
- Open the Google Play Store. Tap your profile icon, then "Manage apps & device."
- Look for Chrome in the list of pending updates, or search for Chrome and tap "Update."
- After installation, verify the version: open Chrome, tap the three-dot menu, then Settings > About Chrome. The version should read 150.0.7871.47 or higher. -
Update Android System WebView
- In the Play Store, search for "Android System WebView." If an update is available, install it.
- To check the installed version, go to Android Settings > Apps > Android System WebView. The version number is usually displayed at the top or in "App details." You should see a build that matches or exceeds the Chrome patch. -
Enable automatic updates
- In the Play Store, go to Settings > Network preferences > Auto-update apps. Choose "Over any network" or "Over Wi-Fi only" to ensure you get fixes as soon as they are released. While this does consume data, it is the safest choice. -
For organizations
- Use your mobile device management platform to push Chrome and WebView updates immediately. Verify compliance with a minimum version rule. Consider temporarily blocking access to sensitive data for devices not yet updated. -
Be cautious about links
- Even after updating, treat links from unknown sources with skepticism. No update can protect against every attack, and a well-crafted phishing message can still trick you into granting permissions or entering credentials.
Outlook
This patch is a reminder that the web remains a hostile environment. Every Chrome release includes dozens of security fixes, many of which are simply labeled "various fixes from internal audits, fuzzing, and other initiatives." The tight integration of WebView into Android's core means that a bug in Chrome can have ripple effects across the entire operating system.
Google's commitment to a predictable release cadence and rapid patching limits the window of exploitation. However, the speed at which users apply updates is often the weak link. A high-severity bug that sits unpatched on millions of phones for weeks is an attractive target.
Looking forward, expect to see more CVEs like this as security researchers dig deeper into the Chromium codebase. The bounty program has matured, and ethical hackers are actively looking for sandbox escapes. Every such bug that gets patched before it is exploited in the wild is a win for the ecosystem.
For users, the message is straightforward: stop hitting "remind me later," and apply browser updates as soon they arrive. It takes a few minutes and can prevent a world of trouble.