CVE-2026-13812: Chrome for iOS Input Validation Flaw Enables XSS Attacks

Technical summary

CVE-2026-13812 is a cross-site scripting (XSS) vulnerability affecting Chrome for iOS versions prior to 150.0.7871.47. The flaw exists in the browser's input validation logic (CWE-20: Improper Input Validation), where untrusted HTML or script content is not properly sanitized before execution. The vulnerability requires user interaction through specific UI gestures on a malicious webpage. The attack succeeds in the context of a single user's browsing session and can break site isolation boundaries, leading to unauthorized script execution within the browser's rendering context.

Business impact

While the CVSS score is moderate (4.7), this vulnerability poses a meaningful risk to iOS users who browse the web using Chrome. Successful exploitation could lead to credential theft through form hijacking, session hijacking, defacement of page content, or redirection to malicious sites. Organizations with iOS-heavy mobile workforces should consider the cumulative risk of their user populations encountering crafted pages. The required user interaction lowers immediate risk but does not eliminate it, especially in targeted attacks against specific users or organizations.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are affected. iOS devices running affected Chrome builds are the primary target. The vulnerability does not affect Chrome on desktop platforms or Chrome on Android (different codebase), but organizations deploying Chrome on iOS devices should prioritize assessment of their iOS user base.

Exploitability

Exploitation requires two conditions: the attacker must create a crafted HTML page and convince a user to perform specific UI gestures within Chrome. This two-step requirement (user interaction plus specific gestures) moderates the exploitability score. However, such gestures are not exotic—they may include swipes, taps, or scrolling actions normal to web browsing. Determined attackers could combine social engineering with crafted pages to increase success rates. The vulnerability is not currently tracked in the KEV catalog, indicating no evidence of active exploitation in the wild at the time of publication.

Remediation

Update Google Chrome for iOS to version 150.0.7871.47 or later immediately. Apple's App Store typically distributes Chrome updates automatically, but users should verify they are running the latest version via Settings > Chrome or by checking the App Store for pending updates. No workarounds exist; patching is the only remediation.

Patch guidance

Verify your iOS device is running Chrome version 150.0.7871.47 or later by opening Chrome, tapping the menu (three dots), selecting 'Settings,' and checking the version number at the top. If your version is lower, visit the App Store and ensure Chrome is updated (enable automatic app updates if desired). Organizations managing iOS devices should use mobile device management (MDM) solutions to enforce Chrome updates across their fleet.

Detection guidance

Monitor for user reports of unexpected script execution, page content changes, or redirects within Chrome on iOS. Endpoint Detection and Response (EDR) tools on managed devices may flag unusual activity following specific user interactions with web content. Network-level detection is limited since the exploit occurs within the browser itself. Consider user awareness training on recognizing suspicious websites and avoiding unfamiliar links, particularly those requesting unusual interaction patterns.

Why prioritize this

This vulnerability merits prompt attention despite its CVSS score. iOS represents a growing share of enterprise mobile devices, and XSS flaws in browsers can lead to account compromise or data theft. The lack of KEV designation suggests no active exploitation yet, providing a window to patch proactively. The requirement for user interaction prevents this from being critical, but the browser's trusted position in accessing sensitive data (email, corporate portals, cloud services) elevates its importance relative to the numerical score alone.

Risk score, explained

The CVSS 3.1 score of 4.7 (Medium) reflects the attack vector (network-based delivery via webpage), high attack complexity (specific UI gestures required), no privileges needed, required user interaction, changed scope (can affect other origins), and limited impact (low confidentiality and integrity, no availability impact). The score appropriately balances the ease of webpage delivery against the user-interaction requirement. The 'changed scope' component acknowledges the XSS nature, where an attacker can break the browser's same-origin policy under certain conditions.

Frequently asked questions