CVE-2026-13839: Google Chrome CSS Same-Origin Policy Bypass (v150.0.7871.47)

Technical summary

CVE-2026-13839 stems from an inappropriate implementation in Chrome's CSS engine that fails to properly enforce same-origin policy restrictions. The vulnerability is classified under CWE-346 (Origin Validation Error) and allows a remote, unauthenticated attacker to craft HTML/CSS that, when loaded in the browser, bypasses origin boundaries. The CVSS 3.1 score of 6.5 (Medium) reflects the requirement for user interaction (clicking a link or visiting a malicious page) and the impact limited to confidentiality rather than system availability or integrity. Chromium's internal severity assessment marked this as High, suggesting the security team's confidence in the exploitability and scope within their ecosystem.

Business impact

While not critical for system availability or integrity, this vulnerability poses a meaningful risk to user data confidentiality. Organizations whose employees browse the web during work hours—particularly those using Chrome as a standard browser—may see sensitive information (authentication tokens, session data, cached content) from internal sites or SaaS applications exposed to attackers. Companies with strict data handling or compliance requirements (HIPAA, PCI-DSS, SOC 2) should view this as a privacy incident vector. The requirement for user interaction (visiting a malicious site) means risk is tied to user behavior rather than being wormable.

Affected systems

This vulnerability affects Google Chrome on all platforms (Windows, macOS, Linux) running versions prior to 150.0.7871.47. Older release branches and legacy Chrome installations that have not received automatic updates are at risk. Organizations using Chrome in managed deployments (via Chrome Enterprise or similar tools) should verify their deployment version against the fixed build number. No other browsers, Chrome derivatives, or Chromium-based products are explicitly listed as affected in the official advisory.

Exploitability

Exploitation requires a user to visit an attacker-controlled or attacker-compromised website. No advanced technical barriers exist once a user is on the malicious page; the vulnerability is reliably triggered by the CSS implementation flaw. The attack does not require any browser extensions, plugins, or other preconditions. User awareness and phishing resistance are the primary mitigations at the behavioral level. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread in-the-wild exploitation has been publicly documented as of the last update.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For individual users, Chrome typically updates automatically; users should check Settings > About Google Chrome to trigger a manual check if needed. Organizations managing Chrome deployments should use their management console (Chrome Enterprise, MDM solutions, or manual policy deployment) to enforce the minimum version requirement. No workarounds exist; patching is the only remediation.

Patch guidance

Verify your Chrome version by navigating to chrome://settings/help or checking the three-dot menu > Help > About Google Chrome. The browser will automatically download and install updates, requiring a restart to apply. For enterprise deployments, consult your Chrome Enterprise or MDM documentation to set version pinning or auto-update policies. Test the patch in a non-production environment first if your organization uses Chrome-dependent internal applications. Document your patching timeline for compliance audit purposes.

Detection guidance

At the endpoint level, monitor Chrome version compliance using your MDM or asset inventory tools; flag any instances below 150.0.7871.47. At the network level, detect exploitation attempts by monitoring for unusual cross-origin requests or data exfiltration patterns from internal sites to external IP addresses, though this is difficult to distinguish from legitimate cross-site requests. Web application firewalls can be tuned to detect malicious CSS payloads if your applications parse user-supplied CSS, though the flaw is in the browser itself, not in web servers. Focus detection efforts on user behavior (unusual login anomalies, data access patterns) rather than network indicators.

Why prioritize this

Assign moderate priority: the vulnerability requires user interaction and carries medium CVSS scoring, but same-origin policy bypass is a fundamental browser security boundary. Organizations with high-risk users (executives, developers, researchers) or strict data compliance requirements should expedite patching. The absence of public KEV status and in-the-wild exploitation activity reduces urgency but does not eliminate it. Prioritize managed deployments (where you control versions) before individual user machines.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network attack vector (AV:N) — attacker is remote; (2) Low attack complexity (AC:L) — no special conditions required; (3) No privileges required (PR:N); (4) User interaction required (UI:R) — user must visit the malicious page; (5) Unchanged scope (S:U) — impact limited to the browser context; (6) High impact to confidentiality (C:H) — sensitive data from other origins is exposed; (7) No impact to integrity or availability (I:N, A:N). The Chromium team's 'High' internal severity suggests they weighted exploitability and real-world risk more heavily than the CVSS numeric score alone conveys.

Frequently asked questions