This vulnerability arises from insufficient validation of untrusted input within the WebAppInstalls component of Google Chrome on Android. An attacker can craft a malicious file that, when processed by the affected version, results in arbitrary code execution. The weakness is an input validation flaw (CWE-1286) in addition to the classic input validation flaw (CWE-20) and is rated Chromium security severity as High.

Google Chrome for Android versions prior to 148.0.7778.216 are affected. Users running these releases on Android devices are at risk unless upgraded to the latest stable channel. No other products or vendors are listed.

Because the flaw requires a local attacker with access to the device, the attack vector is likely local, and exploitation depends on the presence of a malicious file on the device. The EPSS score indicates a very low but non-zero exploitation probability (< 1%), and the vulnerability is not in CISA’s KEV catalog. The severity is high, suggesting significant risk to confidentiality, integrity, and availability once code execution is achieved.