CVE-2026-13816: Google Chrome Android File Input Cross-Origin Data Leak

Technical summary

CVE-2026-13816 is an input validation vulnerability (CWE-20) in the file input handler of Chromium-based Chrome on Android. Insufficient sanitization of untrusted input allows a remote attacker to circumvent same-origin policy protections and leak cross-origin data through a specially crafted HTML page. The vulnerability requires user interaction (visiting the malicious page) but no elevated privileges. Chromium project assigned this a 'High' security severity rating, reflecting the confidentiality impact despite the medium CVSS v3.1 score of 6.5.

Business impact

This vulnerability poses a targeted data theft risk for Android users. If exploited, attackers could extract sensitive information from other open tabs or sessions—such as authentication tokens, personal data, or confidential business information. Organizations with BYOD policies or employees using personal Android devices for work should be particularly concerned. The attack surface is broad because it requires only social engineering (convincing a user to visit a site) rather than complex technical exploitation. Widespread adoption of Chrome on Android means the potential victim population is substantial.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are vulnerable. This includes all Android devices with affected Chrome versions, regardless of Android version, though the vulnerability is specific to the Chromium browser component. Desktop Chrome and Chrome on iOS are not mentioned in this CVE, though users should verify patch status across all platforms.

Exploitability

Exploitability is moderate. The attack requires user interaction—a victim must visit an attacker-controlled or compromised website. No additional authentication, special network conditions, or user privileges are needed. The barrier to exploitation is primarily social engineering. Once a user clicks the malicious link, the browser itself handles the attack transparently. Given Chrome's ubiquity on Android and users' likelihood of visiting untrusted sites, the practical exploitability is concerning despite the CVSS rating not reflecting active in-the-wild exploitation.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. This patch is available through the Google Play Store and should be deployed as soon as possible to all affected devices. Organizations managing Android devices via Mobile Device Management (MDM) should enforce automatic updates or push the patch to reduce the window of vulnerability. Users should enable automatic app updates if not already configured.

Patch guidance

Navigate to Google Play Store, search for 'Google Chrome,' and check for available updates. If version 150.0.7871.47 or later is available, install it immediately. For enterprise deployments, consult your MDM platform (Intune, MobileIron, Jamf, etc.) to push updates to enrolled devices. Verify successful deployment by checking Settings > Apps > Chrome > About Chrome to confirm the installed version meets the patched threshold. No workarounds exist; patching is the only remediation.

Detection guidance

Monitor Chrome version compliance across your Android fleet using MDM reporting tools. Flag devices running Chrome versions below 150.0.7871.47 for priority remediation. On the network side, detection is difficult because the exploit traffic appears as normal browser activity to a cross-origin site. Consider monitoring for unusual authentication anomalies (token theft, session hijacking) that might indicate data exfiltration. User reports of unexplained account activity should be investigated as potential indicators of this vulnerability being exploited.

Why prioritize this

Although the CVSS score is medium (6.5), prioritization should be elevated because: (1) confidentiality impact is high—direct data theft from other origins is the attack goal; (2) no user privilege or complex technical setup is required beyond visiting a page; (3) Chrome on Android has an enormous install base; (4) the attack is transparent to users and difficult to detect in real-time. Organizations should treat this as a timely, high-business-risk patch despite the moderate score.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects: Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), User Interaction (Required), Scope (Unchanged), Confidentiality (High), Integrity (None), Availability (None). The score appropriately captures that user interaction is a limiting factor, but the high confidentiality impact and low attack complexity warrant urgent patching. The Chromium project's independent 'High' severity assessment aligns better with real-world risk because it emphasizes the serious nature of cross-origin data leakage.

Frequently asked questions