CVE-2026-13021: Chrome Same-Origin Policy Bypass via DeviceBoundSessionCredentials

Technical summary

The vulnerability exists in Chrome's DeviceBoundSessionCredentials implementation due to an inappropriate design or validation mechanism. DeviceBoundSessionCredentials are meant to bind session tokens to specific devices and contexts to prevent token theft and misuse. The flaw allows a remote, unauthenticated attacker to craft HTML content that circumvents same-origin policy (SOP) enforcement, potentially reading cross-origin data. This is classified as CWE-346 (Origin Validation Error), indicating the browser's origin validation logic failed to properly isolate security contexts. The attack surface is the rendering engine's credential handling pathway, and exploitation requires the user to visit an attacker-controlled or compromised web page.

Business impact

Data confidentiality is at risk for any user visiting a malicious website while using a vulnerable Chrome version. An attacker could exfiltrate authentication tokens, session cookies, or sensitive application data associated with other origins the user is logged into. For organizations whose users access sensitive web applications through Chrome, this creates a vector for credential theft and unauthorized access to internal or cloud-hosted services. The impact is amplified in environments where users are logged into multiple critical services simultaneously. However, the requirement for user interaction and the information-disclosure-only nature limit the attack to deliberate social engineering rather than widespread, passive compromise.

Affected systems

Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.197 are affected. The vulnerability is platform-independent in Chrome itself, though it affects Chrome installations across all three major operating systems listed in the vendor product data.

Exploitability

Exploitation requires low complexity and no privileges, but does require user interaction (visiting a crafted HTML page). The attack does not require any unusual system configuration or user error beyond clicking a malicious link or visiting a compromised site. An attacker could distribute the malicious HTML via phishing emails, compromised advertisements, or by defacing legitimate websites. The barrier to exploitation is moderate due to the social engineering requirement, but once a user visits the malicious page, the browser flaw is automatically triggered—no additional user actions or clicks are needed.

Remediation

Users should upgrade Chrome to version 149.0.7827.197 or later as soon as possible. Chrome's auto-update mechanism should deliver the patch automatically for most users, but those with updates disabled should manually trigger an update via the browser's settings or download the latest version from google.com/chrome. Organizations should verify deployment of the patched version across their user base through endpoint management tools.

Patch guidance

Update Google Chrome to version 149.0.7827.197 or any subsequent version. Auto-update is the default behavior, so most users will receive the patch within hours of release, though some may require a restart or manual check. Verify the installed version by navigating to Chrome menu > About Google Chrome, which will display the current version and check for updates automatically. For managed deployments, push the update through your mobile device management (MDM) or enterprise configuration tools to ensure coverage across all systems.

Detection guidance

Monitor Chrome version inventory across your organization using endpoint detection and response (EDR) tools, vulnerability scanners, or browser telemetry if available. Check for Chrome versions earlier than 149.0.7827.197 in your fleet. Web application firewalls and network sensors cannot reliably detect exploitation attempts since the attack involves legitimate browser rendering of crafted HTML; focus on version control rather than behavioral detection. If you operate a web application accessible from external users, review access logs for anomalous cross-origin data requests, though such requests may blend into normal traffic if the application is multi-origin aware.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt patching for any organization where users rely on Chrome to access sensitive web applications or authenticate to cloud services. The vulnerability is in a widely deployed browser used by millions, the attack requires only social engineering (not a zero-click exploit), and the impact—unauthorized access to sensitive data across multiple services—can be severe in practice. However, it is not critical because exploitation is not automatic or widespread, and the impact is limited to information disclosure without code execution or system compromise. Prioritize patching for users in high-value roles or those accessing particularly sensitive systems.

Risk score, explained

The CVSS score of 4.3 (MEDIUM) reflects a network-based, low-complexity attack requiring user interaction that results in low confidentiality impact and no impact to integrity or availability. The score appropriately captures that this is not a wormable or widespread attack vector, but understates the real-world severity in environments where users are authenticated to multiple sensitive services. Organizations should consider their specific threat model: if users frequently log into high-value applications via Chrome, the practical risk may warrant treating this as HIGH priority despite the MEDIUM score.

Frequently asked questions