CVE-2026-13822: Chrome Android Same-Origin Policy Bypass via Malicious Extension

Technical summary

CVE-2026-13822 is a same-origin policy bypass vulnerability in the Chrome Extensions implementation on Android. The root cause is an inappropriate implementation that fails to properly enforce origin restrictions when a malicious extension requests access to web content. The vulnerability is triggered through a crafted Chrome Extension and relates to CWE-346 (Origin Validation Error). While the Chromium security team assigned it High severity internally, the CVSS 3.1 score of 6.5 (Medium) reflects the user interaction requirement: an attacker must convince the user to install the malicious extension first. Once installed, the extension gains the ability to violate cross-origin boundaries.

Business impact

For organizations whose workforce uses Android devices with Chrome as a primary browser, this vulnerability creates a credential and data theft risk. Employees could become targets of social engineering campaigns that distribute malicious extensions, potentially leading to unauthorized access to corporate web applications, email, or SaaS platforms. The attack surface is broadened if users have permissions to install extensions from non-official sources or if enterprise mobile device management does not restrict extension installation. Data exfiltration and account compromise are the primary business concerns.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. The vulnerability is specific to the Android version of Chrome; desktop and iOS versions are not affected. Any user who installs a malicious extension on a vulnerable version is at immediate risk. Organizations should verify current Chrome versions across their Android device inventory.

Exploitability

Exploitability requires user interaction—the attacker must convince the user to install a malicious extension, typically through social engineering, phishing, or compromised app stores. Once installed, no further user interaction is needed; the malicious extension can immediately abuse the same-origin policy bypass to access sensitive data. The attack does not require network-level privileges or complex exploitation techniques. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the straightforward attack chain and high impact make it an attractive target for threat actors.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users should enable automatic updates in the Google Play Store to receive patches as soon as they are released. Organizations should enforce minimum Chrome version policies through mobile device management (MDM) controls where available. Additionally, restrict or audit extension permissions and consider blocking installation from untrusted sources.

Patch guidance

Apply Chrome version 150.0.7871.47 or later on all Android devices. This patch is available through the Google Play Store. Users can check their Chrome version by navigating to Settings > About Chrome, which will automatically check for and install updates. For Android Enterprise deployments, use MDM policies to enforce the minimum version requirement and prevent downgrade attacks. Verify patch deployment through MDM telemetry within 7–14 days of the update's availability.

Detection guidance

Monitor for unexpected extension installations on Android devices, particularly extensions from non-official sources or those with suspicious permissions (e.g., access to all websites, camera, or microphone). Endpoint detection and response (EDR) tools should flag any unusual data exfiltration attempts from the Chrome process. Review Chrome extension audit logs if your organization uses Chrome Enterprise. Network monitoring for outbound connections from the Chrome process to unexpected domains may indicate malicious extension activity. Cross-reference installed extensions with reputable blocklists maintained by Google and third-party security vendors.

Why prioritize this

While the CVSS score is Medium (6.5), the vulnerability warrants higher prioritization because it enables same-origin policy bypass, one of the web platform's fundamental security mechanisms. The user interaction requirement does lower immediate risk, but Android users are frequent targets of malicious app distribution campaigns. Organizations with high-value users (executives, developers, finance teams) should prioritize patching to reduce credential theft and espionage risk. The lack of KEV listing suggests limited real-world exploitation to date, but this may change as awareness spreads.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: Attack Vector Network (N), Attack Complexity Low (L), Privileges Required None (PR:N), User Interaction Required (UI:R), Scope Unchanged (S:U), Confidentiality Impact None (C:N), Integrity Impact High (I:H), Availability Impact None (A:N). The high integrity impact (malicious modification of web content, session hijacking, credential theft) is offset by the mandatory user interaction step (tricking the user into installing the extension). The score appropriately captures that this is a significant integrity threat conditional on social engineering success.

Frequently asked questions