CVE-2026-13826: Chrome Android Autofill Cross-Origin Data Leak

Technical summary

CVE-2026-13826 is an origin-bypass vulnerability in the Chromium autofill implementation affecting Android versions prior to 150.0.7871.47. The vulnerability stems from inappropriate security controls in the autofill subsystem (CWE-346: Origin Validation Error, CWE-352: Cross-Origin Information Leak). An attacker with a compromised renderer process can craft malicious HTML to exfiltrate cross-origin data that should be protected by the same-origin policy. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network attack complexity, user interaction requirement, and high confidentiality impact without integrity or availability loss.

Business impact

Data breach risk for users of Chrome on Android, particularly those whose credentials or autofilled payment information could be extracted if the renderer is compromised through separate attack chains. Organizations relying on Chrome for business workflows on mobile devices should assess whether sensitive workflows are exposed. The impact is confidentiality-focused; integrity and availability remain unaffected. Given the requirement for prior renderer compromise, this is a chaining vulnerability that amplifies the impact of other sandbox escapes or process injection attacks.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47. The vulnerability is specific to the Android platform and does not affect Chrome on Windows, macOS, Linux, iOS, or ChromeOS based on the CVE description. Organizations running or supporting Android mobile fleets with Chrome should prioritize patching. The autofill feature is enabled by default, so all affected Chrome instances are potentially vulnerable if the renderer is compromised.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the Chrome renderer process, typically through a separate vulnerability or attack vector, and (2) the victim must then visit a specially crafted webpage under attacker control. This layered requirement limits widespread opportunistic exploitation, but it creates a critical vulnerability when chained with renderer sandbox escapes or process hijacking techniques. The attack does not require elevated privileges or complex setup beyond the initial renderer compromise. Real-world exploitation is not currently documented in public disclosure feeds.

Remediation

Update Chrome on Android to version 150.0.7871.47 or later immediately. This patch implements proper origin validation and cross-origin data leak prevention in the autofill engine. Verify the installed version through Chrome Settings > About Chrome, which will auto-check for updates. Users should also audit for any unusual autofill behavior or unexpected data leakage during the interim period before patching.

Patch guidance

Google has released Chrome 150.0.7871.47 for Android as the stable fix. The patch should roll out through Google Play Store; enable automatic app updates or manually check for updates in Google Play. Enterprise administrators managing Chrome through mobile device management (MDM) should push this version to enrolled Android devices and verify deployment. Patching is critical for any organization using Chrome on Android for workflows involving stored credentials or payment data.

Detection guidance

Monitor for Chrome process crashes or unusual autofill popups appearing on unrelated pages, which may signal exploitation attempts. Network-level detection is limited because the attack occurs within the browser process itself; focus on endpoint detection through Chrome crash reports and autofill event logs if available through MDM. Behavioral indicators include sudden requests to exfiltrate autofill data or anomalous cross-origin data flows during browsing sessions. Organizations without MDM coverage should rely on user reporting and manual version verification.

Why prioritize this

Although the CVSS score is Medium (6.5), this vulnerability merits elevated prioritization because it directly threatens high-value stored data (credentials and payment details) on a widely-used mobile platform. The requirement for renderer compromise means it will likely be chained with other exploits in targeted campaigns against high-value targets or enterprise environments. For organizations supporting sensitive mobile workflows or BYOD environments, this should be treated as Priority 1 despite the moderate CVSS.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects Medium severity: network-based attack requiring user interaction, no privilege escalation needed, and only confidentiality impact. However, CVSS underweights the significance because it assumes a standalone vulnerability; in practice, this is a chaining primitive that becomes Critical when combined with renderer exploits. The 'UI:R' (User Interaction Required) component accounts for the need to visit a malicious page, though that barrier is relatively low given typical browsing behavior.

Frequently asked questions