Insufficient validation of untrusted input in WebAppInstalls allows a local attacker to place a malicious file that can escape Chrome’s sandbox, potentially leading to arbitrary code execution or device compromise on Android. The flaw is classified as CWE‑20 and is rated medium severity by Chromium security, but the CVSS score of 9.1 indicates high potential impact.

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable when a malicious file is introduced through WebAppInstalls.

Based on the description, it is inferred that the CVSS score of 9.1 signals a severe risk, while the EPSS score of less than 1% and its absence from the CISA KEV catalog indicate a low probability of exploitation. However, because the flaw permits sandbox escape, successful exploitation could yield arbitrary code execution. The vulnerability requires local access and the ability to supply a malicious file. The exploitation scenario presumes the attacker can place a malicious file in a location WebAppInstalls.