CVE-2026-13809: iOS Chrome Safe Browsing Side-Channel Information Leakage

Technical summary

CVE-2026-13809 is a side-channel information leakage vulnerability in the Safe Browsing implementation within Google Chrome on iOS. The flaw exists prior to version 150.0.7871.47 and is triggered when a malicious HTML page is rendered in a compromised renderer process. The vulnerability violates the same-origin policy's confidentiality guarantees, allowing exfiltration of cross-origin data that should remain isolated. The attack vector is network-based with low attack complexity, but requires user interaction and assumes prior renderer process compromise. The Chromium project rated this as High severity internally, though the CVSS v3.1 score reflects the prerequisite of renderer compromise.

Business impact

If exploited, this vulnerability could enable attackers to extract sensitive user data—such as authentication tokens, personal information, or financial details—from websites the user visits. The impact is particularly concerning in contexts where multiple sensitive sites are accessed in the same browser session. Organizations should evaluate whether their users rely on iOS Chrome for accessing sensitive applications. The prerequisite of renderer process compromise means this vulnerability is most dangerous when combined with other exploits, potentially amplifying the damage from multi-stage attacks.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the iOS platform and does not apply to Chrome on Android, Windows, macOS, or Linux. Apple's iOS is also listed as an affected vendor/product, reflecting the platform-level dependency. Any organization or user with Chrome on iOS should prioritize patching to version 150.0.7871.47 or later.

Exploitability

Exploitability requires two conditions: (1) the attacker must have already compromised the Chrome renderer process, and (2) the user must visit a page containing the malicious HTML. This two-stage requirement lowers the attack profile compared to a direct remote code execution. However, in scenarios where attackers already control the renderer—via a separate vulnerability or malware—this flaw becomes a high-value information exfiltration primitive. The vulnerability is not tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no observed active exploitation at publication time.

Remediation

The primary remediation is to update Google Chrome on iOS to version 150.0.7871.47 or later. Google has addressed the underlying side-channel in the Safe Browsing module. Users and administrators should enable automatic updates for Chrome to ensure timely patching. Additionally, defense-in-depth measures such as using password managers, enabling multi-factor authentication, and monitoring for unusual account activity help reduce the impact if cross-origin data leakage occurs.

Patch guidance

Update Google Chrome on iOS to version 150.0.7871.47 or any subsequent release. On iOS, users can enable automatic app updates via the App Store settings (Settings > [Your Name] > App Store > App Updates toggle). Administrators managing iOS devices via Mobile Device Management (MDM) solutions should push this update through their MDM platform. Verify successful patching by navigating to Chrome settings (three-dot menu > Settings > About Chrome) to confirm the version number. No manual configuration changes are required post-patch.

Detection guidance

Monitor for signs of renderer process compromise, which is the prerequisite for this vulnerability's exploitation. Detection strategies include: (1) observe for unusual process memory access or system calls within Chrome; (2) log and alert on unexpected network connections originating from Chrome, particularly to unfamiliar domains; (3) monitor for changes to Chrome's extension list or policy settings; (4) track version compliance across your iOS fleet to identify unpatched devices. Network-level detection is limited since the attack occurs within the browser; endpoint Mobile Threat Defense solutions on iOS may flag suspicious behavior patterns.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability should be prioritized for patching due to its role in data exfiltration chains. Its position in the attack sequence—as a post-compromise information theft mechanism—makes it valuable to attackers already inside the renderer. The absence of KEV listing suggests it is not yet widely exploited, providing a window to patch before adoption increases. Given the sensitive nature of data accessible through browsers, organizations should treat this as higher priority than the CVSS base score alone suggests.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects the following factors: Attack Vector (Network) and low Attack Complexity increase score; no privileges or special configuration required (PR:N); requires user interaction (UI:R); scope is unchanged; confidentiality impact is high (user data leakage), but integrity and availability are unaffected. The renderer process compromise prerequisite is not formally captured in CVSS, which explains why the internal Chromium severity rating is High despite the CVSS classification. Organizations should weight both the technical score and the Chromium assessment when prioritizing.

Frequently asked questions