Description
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper input validation in Chrome’s WebAppInstalls feature on Windows. The flaw allows a maliciously crafted HTML page to be served to a user, enabling an attacker to read from or overwrite arbitrary memory locations within the Chrome process. This grants the attacker potential compromise of data confidentiality and integrity for the user session, although it does not provide high‑privileged code execution.

Affected Systems

Any installation of Google Chrome running on Windows that has not yet been updated to version 150.0.7871.47 is vulnerable. The issue specifically impacts the desktop channel of Chrome, and may affect any Windows installation where the WebAppInstalls component is enabled.

Risk and Exploitability

The CVSS score of 8.1 indicates a high impact potential. The EPSS score of <1% suggests that, at present, the likelihood of exploitation is low, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote web content; an attacker would need to host a malicious HTML document or phishing site that a user opens in Chrome.

Generated by OpenCVE AI on July 15, 2026 at 10:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.47 or newer as soon as possible.
  • Set the "WebAppInstallsAllowed" policy to disable the WebAppInstalls feature.
  • Apply device‑management or GPO policies to enforce process sandboxing for untrusted web content.

Generated by OpenCVE AI on July 15, 2026 at 10:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 15 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Chrome WebAppInstalls Input Validation Enables Arbitrary Read/Write

Tue, 14 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Chrome WebAppInstalls Input Validation Enables Arbitrary Read/Write

Mon, 13 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title Arbitrary Read/Write via WebAppInstalls in Chrome on Windows

Sun, 12 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Arbitrary Read/Write via WebAppInstalls in Chrome on Windows

Sat, 11 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Chrome WebAppInstalls Improper Input Validation Exploited for Arbitrary Memory Read/Write

Fri, 10 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Chrome WebAppInstalls Improper Input Validation Exploited for Arbitrary Memory Read/Write

Fri, 10 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Arbitrary Read/Write via WebAppInstalls in Chrome on Windows

Thu, 09 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Arbitrary Read/Write via WebAppInstalls in Chrome on Windows

Wed, 08 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Insufficient validation allows remote read/write via crafted HTML in Chrome WebAppInstalls

Tue, 07 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Insufficient validation allows remote read/write via crafted HTML in Chrome WebAppInstalls

Mon, 06 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title WebAppInstalls memory read/write vulnerability in Google Chrome on Windows

Sun, 05 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title WebAppInstalls memory read/write vulnerability in Google Chrome on Windows

Sun, 05 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Title Arbitrary Memory Read/Write via Crafted HTML Page in Chrome WebAppInstalls

Sat, 04 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Arbitrary Memory Read/Write via Crafted HTML Page in Chrome WebAppInstalls

Sat, 04 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Remote attacker can read/write arbitrary memory via crafted HTML in Chrome WebAppInstalls on Windows

Fri, 03 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title Remote attacker can read/write arbitrary memory via crafted HTML in Chrome WebAppInstalls on Windows

Fri, 03 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Chrome WebAppInstalls Allows Remote Arbitrary Read/Write

Thu, 02 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Chrome WebAppInstalls Allows Remote Arbitrary Read/Write

Thu, 02 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Insufficient Validation Allowing Arbitrary Read/Write in Chrome WebAppInstalls on Windows

Wed, 01 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation Allowing Arbitrary Read/Write in Chrome WebAppInstalls on Windows

Wed, 01 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Chrome WebAppInstalls Allows Arbitrary Read/Write via Crafted HTML Page

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Chrome WebAppInstalls Allows Arbitrary Read/Write via Crafted HTML Page

Wed, 01 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unvalidated Input Permitting Arbitrary Read/Write in Chrome WebAppInstalls

Wed, 01 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Unvalidated Input Permitting Arbitrary Read/Write in Chrome WebAppInstalls

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T18:34:39.880Z

Reserved: 2026-06-29T23:11:46.549Z

Link: CVE-2026-14122

cve-icon Vulnrichment

Updated: 2026-07-01T14:26:05.564Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T10:45:06Z

Weaknesses
  • CWE-20

    Improper Input Validation