CVE-2026-13847: Chrome iOS Cross-Origin Data Leak Vulnerability

Technical summary

The vulnerability stems from insufficient input validation (CWE-20) in Chrome's iOS rendering engine. The flaw allows a remote attacker to bypass same-origin policy protections through a crafted HTML document. When processed by the vulnerable browser, the malicious page can access or exfiltrate data associated with other origins—including authentication tokens, cookies, or sensitive content from other websites. The attack vector is network-based, requires no special privileges, and is triggered by user interaction (visiting the malicious page). The impact is strictly confidentiality; there is no code execution, denial of service, or data modification.

Business impact

Organizations whose users access sensitive web applications via Chrome on iOS face a temporary risk of credential and data exposure. Financial services, healthcare platforms, enterprise portals, and SaaS applications are potential targets. An attacker could weaponize this to steal session tokens, extract personal information, or exfiltrate proprietary data. The attack requires social engineering to lure users to a malicious site but could be combined with phishing or watering-hole campaigns for scale. The window of exposure is limited to devices running unpatched Chrome versions.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the iOS platform; Chrome on Android, macOS, Windows, and Linux are not impacted by this particular flaw. All iOS users with Chrome installed and not yet updated to version 150.0.7871.47 or later are at risk.

Exploitability

The vulnerability has a CVSS score of 6.5 (Medium severity) and is not currently listed on CISA's Known Exploited Vulnerabilities catalog, indicating no publicly confirmed active exploitation at the time of publication. The attack requires user interaction—a victim must be tricked into visiting a crafted web page—which limits the attack surface compared to network-only or local vulnerabilities. However, the barrier to exploitation is low: the attacker needs only HTML crafting skills and a method to distribute the malicious page (phishing, ads, compromised websites). Once a user visits, the exploitation is automatic.

Remediation

Users must update Chrome for iOS to version 150.0.7871.47 or later. Apple's App Store typically pushes updates automatically, but users can manually check for updates in the App Store or Chrome settings. Organizations should communicate the availability of this patch to iOS users and encourage immediate installation, especially for users who access sensitive web applications. No workarounds exist; patching is the only mitigation.

Patch guidance

Google has addressed this vulnerability in Chrome for iOS version 150.0.7871.47. Users should enable automatic updates in the App Store to receive the patch without manual intervention. IT administrators managing iOS devices via MDM (Mobile Device Management) solutions should verify their deployment of Chrome updates and confirm patch rollout across the fleet. Check the Apple App Store or Google Chrome release notes for verification that your installed version matches or exceeds 150.0.7871.47.

Detection guidance

Detection is difficult on the endpoint side because the attack manifests as normal browsing traffic to a malicious HTML page. Network-based detection could look for anomalous cross-site data exfiltration patterns or identify known malicious pages hosting this exploit. Web application security teams should monitor for unusual access patterns or data leaks correlating with the vulnerability timeline. Encourage users to report suspicious pages or unexpected authentication prompts. Validate Chrome version compliance across your iOS fleet using MDM reporting or by requiring users to confirm their version in a security assessment.

Why prioritize this

Although the CVSS score is Medium (6.5) and no active exploitation is confirmed, this vulnerability affects a widely-used platform (iOS Chrome) and compromises a fundamental security boundary (same-origin policy). Cross-origin data leaks can expose authentication credentials and personal information at scale if weaponized in a phishing campaign. Prioritization should be high for organizations whose employees use iOS devices to access web-based business applications, particularly in regulated industries or those handling sensitive data. The easy distribution and low detection overhead make this a practical target for attackers despite the user interaction requirement.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) but user interaction (UI:R). The impact is limited to confidentiality (C:H), with no integrity or availability compromise (I:N, A:N). The score appropriately captures the severity of cross-origin data leakage while acknowledging the user-interaction gate. However, organizations handling highly sensitive data or with large iOS user bases should treat this as high priority for rapid patching, as the real-world impact can exceed the base CVSS rating.

Frequently asked questions