CVE-2026-13793: Cross-Origin Data Leak in Google Chrome SVG Policy Enforcement

Technical summary

The vulnerability stems from insufficient policy enforcement in Chrome's SVG handling prior to version 150.0.7871.47. SVG is an XML-based image format that can contain embedded scripts and references to external resources. The flaw allows a crafted HTML page to bypass security boundaries and access sensitive data from cross-origin contexts. The attack vector is network-based with low attack complexity, requiring only user interaction (visiting a malicious page). The vulnerability maps to CWE-346 (Origin Validation Error), indicating the root cause is improper validation or enforcement of origin boundaries when processing SVG content. Chromium rated this as High severity internally, though the CVSS 3.1 score of 6.5 reflects the UI requirement and scope limitation (confidentiality impact only, no integrity or availability risk).

Business impact

Organizations face a direct risk to user privacy and data confidentiality. If employees visit a compromised or attacker-controlled website while logged into sensitive cloud services or internal web applications, session data, authentication tokens, personal information, or other sensitive content could be extracted. This is particularly concerning for users with administrative roles or access to confidential systems. Additionally, enterprises supporting remote workforces may face elevated risk if employees use Chrome on personal or less-controlled networks. Incident response and forensics become harder because the exfiltration leaves minimal artifacts—no malware, no obvious breach indicators.

Affected systems

The vulnerability affects Google Chrome on multiple platforms: Windows, macOS, and Linux systems running Chrome prior to version 150.0.7871.47. Any user running an unpatched Chrome browser is at risk. The listing includes broad platform categories (Windows, macOS, Linux) because Chrome is cross-platform and the SVG policy enforcement flaw exists in the Chromium engine across all distributions. Organizations should verify their Chrome deployment versions across all endpoints.

Exploitability

Exploitability is moderate. The attack requires a user to visit an attacker-controlled or compromised website, making it dependent on social engineering or a successful website compromise. However, once the victim arrives at the malicious page, no additional user actions beyond the initial visit are needed—JavaScript execution is sufficient to trigger the SVG policy bypass and leak data. The attack is not remotely exploitable without user interaction, but the interaction barrier is low (a single click or automatic redirect). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active real-world exploitation has not been publicly disclosed or tracked as of the publication date.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later. Chrome's built-in auto-update mechanism typically handles this, but verify completion on all managed endpoints. Organizations should enforce Chrome version pinning or auto-update policies via management tools (Google Admin Console for enterprise deployments). For organizations using Chromium-based browsers (Edge, Brave, etc.), check vendor advisories for corresponding patched versions, as they may share the same vulnerability. Consider blocking access to Chrome from non-compliant devices until patches are applied.

Patch guidance

Google Chrome users should update to 150.0.7871.47 or later via Settings > About Chrome, which triggers automatic download and installation (with a browser restart required for activation). Enterprise administrators can deploy the patch through managed device policies and should verify deployment completion through device inventory tools. For organizations on extended release channels or using older versions, expedite the update schedule. After patching, confirm the running version matches 150.0.7871.47 or higher by navigating to chrome://version. No workarounds or configuration mitigations exist; patching is the only remediation.

Detection guidance

Detection is difficult at the network level because the attack involves legitimate HTTPS traffic to attacker-controlled websites and standard SVG rendering. Endpoint detection should focus on anomalous Chrome process behavior or unexpected cross-origin requests in browser automation or plugin logs, though this requires enhanced monitoring. User awareness training is more effective: educate staff on phishing and suspicious links, and encourage reporting of unexpected page behavior. Browser history forensics on compromised or suspicious devices may reveal visits to malicious sites. Consider deploying a Secure Web Gateway or DLP tool that can inspect HTTPS traffic (with decryption) to flag suspicious SVG content, though this adds overhead. Monitor Chrome crash reports or error logs for SVG-related failures that might indicate exploitation attempts.

Why prioritize this

While the CVSS score is moderate (6.5 / Medium), this vulnerability directly threatens the confidentiality of sensitive user data through a breach of the same-origin policy, a cornerstone of browser security. The ease of exploitation (requires only a user visit to a malicious page) combined with the high business impact (cross-origin data theft) elevates the priority. Organizations handling sensitive data, operating web applications with authentication, or supporting high-value user accounts should treat this as critical. The lack of KEV listing does not reduce the threat; it reflects the recency of the advisory and limited public exploitation reporting to date. Patch within 5–7 business days for critical deployments.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: (1) Network attack vector—exploitable remotely via a crafted webpage; (2) Low attack complexity—no special conditions required; (3) No privileges needed to exploit; (4) User interaction required—victim must visit the malicious page; (5) Confidentiality impact rated High—sensitive cross-origin data is exposed; (6) Integrity and Availability rated None—the vulnerability does not allow data modification or service disruption. The score appropriately weights the UI requirement as a limiting factor but acknowledges the serious confidentiality breach. Organizations should consider the business context (sensitivity of user data) as additional input to local risk scoring; context may elevate the effective risk above the base CVSS score.

Frequently asked questions