CVE-2026-13795: Chrome iOS Navigation Bypass Vulnerability – Patch Guidance

Technical summary

CVE-2026-13795 stems from insufficient policy enforcement in Chrome's iOS implementation. The vulnerability permits circumvention of navigation restrictions—security controls that prevent unwanted redirects or forced navigation to sensitive URLs—via a malicious HTML page. The issue is classified as CWE-602 (Client-Side Enforcement of Server-Side Security), indicating the browser's client-side navigation policy is not adequately enforced. An unauthenticated remote attacker requires only user interaction (visiting the page); no special privileges or complex conditions are needed. Google rated this High severity at the Chromium level, though the CVSS 3.1 score of 6.5 (Medium) reflects that integrity impact is present but confidentiality and availability are not directly compromised.

Business impact

Navigation restriction bypasses can be exploited for phishing at scale or credential harvesting. An attacker could craft a convincing page that, when visited, forces navigation to a look-alike authentication portal or sensitive internal site, tricking users into revealing credentials or sensitive information. For organizations with BYOD policies or iOS-heavy user bases, widespread Chrome adoption on iOS increases attack surface. The barrier to exploitation is low—only user interaction on a malicious page is required—making this a viable vector for targeted or mass campaigns.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 is vulnerable. iOS devices running affected Chrome builds are at risk. Desktop or Android Chrome versions are not mentioned as affected. Organizations should inventory Chrome deployments on iOS devices and prioritize updates. The vulnerability requires a victim to actively use Chrome and visit a malicious page; Safari or other iOS browsers are not affected by this specific issue.

Exploitability

Exploitability is straightforward: an attacker creates a malicious HTML page and distributes the link via email, social media, messaging apps, or other channels. No special technical sophistication, zero-day knowledge, or browser extension is required. The user must visit the page and interact with it, but no additional clicks or complex user action beyond initial navigation is necessary. This is a practical, low-friction attack that requires only social engineering to distribute the malicious link. The lack of KEV (Known Exploited Vulnerability) designation does not rule out active exploitation; it indicates CISA has not yet observed public or widespread weaponized proof-of-concept code.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users should enable automatic updates via the iOS App Store settings for Chrome or manually check for updates in the Chrome app menu. IT administrators managing device fleets should verify that Mobile Device Management (MDM) policies enforce Chrome auto-updates or push a manual update cycle. For organizations unable to immediately patch, educate users about the risks of visiting untrusted links and consider network-level controls (proxy filtering, DNS blocking) to reduce exposure to known malicious domains.

Patch guidance

Google Chrome for iOS receives updates through the Apple App Store. Users should navigate to the App Store, search for Google Chrome, and install the latest version. Automatic updates via App Store settings (Settings > [Your Name] > App Store > Auto-Downloads) will pull version 150.0.7871.47 or later when released. Administrators using Apple Business Manager or MDM can configure Chrome deployment to enforce minimum version 150.0.7871.47. Verify the update in Chrome's About menu (Settings > About Google Chrome) to confirm the current version. No manual workaround is available; updating is the only mitigation.

Detection guidance

Monitor for Chrome on iOS versions below 150.0.7871.47 via MDM reports or enterprise device inventory tools. Look for telemetry from security proxies or endpoint agents showing unpatched Chrome installations. In network logs, suspicious patterns of forced redirects from Chrome-iOS user agents to sensitive domains (especially after visiting unfamiliar external sites) may indicate exploitation attempts. Endpoint detection and response (EDR) tools on managed iOS devices can flag Chrome processes attempting unexpected navigation to blocked or restricted URLs. User reports of unexpected redirects in Chrome should trigger investigation.

Why prioritize this

Although rated CVSS Medium (6.5), this warrants prompt prioritization because: (1) exploitation is trivial and requires only social engineering, (2) the attack surface is large—any user of Chrome on iOS is at risk from a malicious link, (3) the business impact (credential theft, phishing) is high despite the technical CVSS score, and (4) iOS devices often lack endpoint security controls, making them harder to monitor and protect than desktop systems. Prioritize inventory and patching of iOS Chrome deployments before conducting phishing simulation campaigns.

Risk score, explained

CVSS 3.1 score of 6.5 (Medium) reflects: Network-based attack vector (AV:N), Low complexity (AC:L), no privileges required (PR:N), and user interaction needed (UI:R). Integrity impact is High (I:H) because an attacker can force navigation to unintended destinations, compromising trust in the application's routing. Confidentiality and availability are Not impacted (C:N, A:N) because navigation bypass does not leak data or crash the browser. The score does not capture the practical exploitability or business risk; security teams should weight this as higher priority than the numeric score alone suggests given the low barrier to exploitation and social engineering effectiveness.

Frequently asked questions