CVE-2026-13808: Chrome on iOS Data Validation Flaw—Local Memory Exposure

Technical summary

CVE-2026-13808 stems from insufficient input validation in Chrome for iOS, classified under CWE-20 (Improper Input Validation). The vulnerability permits a local threat actor to read process memory containing potentially sensitive information via direct physical interaction with the device. The Chromium security team rated this as High severity from their internal perspective, though the CVSS 3.1 score of 4.6 reflects the requirement for physical access (AV:P). No remote exploitation is possible, and user interaction is not required to trigger the memory leak once an attacker has device access.

Business impact

Organizations managing iOS devices with Chrome deployed should recognize that this vulnerability does not pose a network-based threat or require user action to exploit. However, any scenario involving shared or accessible devices—such as kiosks, demo units, or facilities where temporary physical access might occur—presents a genuine risk. The exposure could include cached credentials, session tokens, or other sensitive browser state. For most enterprises, this is a moderate concern, but financial services, healthcare, and other regulated sectors handling sensitive data should prioritize remediation.

Affected systems

This vulnerability affects Google Chrome on iOS running version 150.0.7871.47 and earlier. The underlying issue is specific to the iOS version of Chrome and does not impact Chrome on Android, macOS, Windows, or Linux. All iOS users running the affected Chrome versions are at risk if their device can be physically accessed by an attacker. Since Apple controls the iOS platform, remediation depends on a Chrome update distributed through Apple's App Store.

Exploitability

Exploitation requires physical possession of an unlocked or minimally-locked iOS device running the vulnerable Chrome version. An attacker cannot exploit this remotely, nor can they trigger it through a link or email. The barrier to exploitation is deliberate physical access, which significantly limits real-world attack surface in most environments. However, the lack of user interaction requirements means that once an attacker has the device in hand, successful memory extraction is likely. This vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog as of the latest data.

Remediation

Update Chrome on iOS to version 150.0.7871.47 or later. This is a straightforward app update available through the Apple App Store. Organizations should verify that their iOS deployment policies enable automatic app updates or push the new Chrome version through their mobile device management (MDM) solution if one is in place. No workarounds exist; patching is the only mitigation.

Patch guidance

Install Chrome version 150.0.7871.47 or any subsequent version. Users can manually check for updates by opening Chrome, navigating to Settings > About Chrome, and allowing the update to complete. Enterprise deployments leveraging MDM solutions (such as Intune, MobileIron, or Jamf) should push this version to all managed iOS devices running Chrome. Test the update on a representative device first to ensure compatibility with your organization's apps and workflows. Given the low CVSS score and local-only attack vector, standard patch windows are appropriate, though devices handling highly sensitive data should be prioritized.

Detection guidance

Detection of exploitation is challenging without access to device memory forensics or enhanced logging. Organizations with MDM in place can query device inventory to identify any iOS devices still running Chrome versions prior to 150.0.7871.47 and flag them for update. If forensic investigation is warranted, examine Chrome's cache, session storage, and memory dumps for signs of unauthorized extraction. Most organizations will not have visibility into individual memory access events; focus instead on ensuring patch compliance.

Why prioritize this

Although rated CVSS 4.6 (Medium), prioritize this vulnerability according to your device landscape and data sensitivity. High-risk factors: managed iOS devices handling PII, credentials, or authentication tokens; shared or kiosk-style devices; environments where physical access controls are weak. Lower-risk factors: personal devices, highly controlled physical access, or minimal sensitive data cached in Chrome. Given the straightforward patch path and zero remote exploitation risk, this is a remediation task rather than an emergency incident.

Risk score, explained

The CVSS 3.1 score of 4.6 reflects a Medium severity because the attack vector is physical (AV:P), which significantly reduces likelihood, but confidentiality impact is rated High (C:H). The severity would be much higher if remote exploitation were possible. The local-only requirement and lack of integrity or availability impact keep the score in the moderate range. Chromium's internal 'High' rating acknowledges the sensitivity of data at risk, but CVSS properly accounts for attack feasibility.

Frequently asked questions