CVE-2026-13850: Chrome iOS Input Validation RCE – Patch Guidance

Technical summary

CVE-2026-13850 is an input validation vulnerability (CWE-20) affecting Chrome on iOS prior to version 150.0.7871.47. The vulnerability stems from insufficient validation of untrusted input in the iOS-specific Chrome implementation. An attacker with local access to the device can craft a malicious file that bypasses input validation checks, leading to arbitrary code execution within the Chrome sandbox. The Chromium project rates this as High severity, and the CVSS 3.1 score of 8.8 reflects the combination of network-adjacent attack vector, low attack complexity, no privilege requirements, required user interaction, and high impact across confidentiality, integrity, and availability.

Business impact

iOS users of Chrome face potential data theft or manipulation through successful exploitation of this vulnerability. An attacker could exfiltrate browsing history, cached credentials, cookies, or other sensitive data stored by the browser. Additionally, the ability to execute arbitrary code—even within a sandbox—could enable lateral movement to other applications or system components on the device, particularly if additional privilege escalation vulnerabilities are chained. Organizations with iOS-using employees who rely on Chrome should prioritize patching to prevent credential compromise and data loss.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 150.0.7871.47 are vulnerable. This includes all recent iPhone and iPad models running affected Chrome builds. Desktop Chrome versions and Chrome on Android are not affected by this specific vulnerability. The issue is isolated to the iOS platform's implementation of Chrome.

Exploitability

Exploitation requires local access to an iOS device and user interaction—specifically, the victim must open or interact with a malicious file within Chrome. The attack vector indicates network-adjacent capability, meaning the attacker could deliver the malicious file via email, messaging, or web download. The low attack complexity suggests the exploit is straightforward once the malicious file is crafted. While this is not a wormable remote code execution flaw, the combination of low barriers to delivery and reliable execution within the sandbox makes it a meaningful threat in targeted attack scenarios.

Remediation

Immediately update Google Chrome on iOS to version 150.0.7871.47 or later. Users should enable automatic app updates on their iOS devices to receive patches without manual intervention. Organizations managing iOS devices via mobile device management (MDM) solutions should push Chrome updates through their MDM console. Verify that the Chrome update has completed by checking Settings > Apps or the App Store and confirming the installed version matches or exceeds the patched release.

Patch guidance

Update Chrome on iOS through the App Store. Open the App Store app, navigate to Updates, locate Google Chrome, and tap Update. Alternatively, enable automatic updates: Settings > App Store > toggle on 'App Updates' to receive patches automatically. Verify successful installation by launching Chrome, tapping the menu icon (three dots), selecting 'About Google Chrome,' and confirming the version number is 150.0.7871.47 or higher. No manual configuration changes are required post-update.

Detection guidance

Monitor Chrome version numbers across your iOS fleet using MDM solutions. Check installed Chrome versions via device inventory reports; flag any devices running Chrome below 150.0.7871.47. Endpoint detection and response (EDR) platforms with iOS support may log suspicious file handling attempts within Chrome sandbox boundaries, though visibility is limited due to iOS sandboxing restrictions. Review device access logs and application crash reports for anomalous behavior correlating with Chrome usage or file interactions.

Why prioritize this

This vulnerability merits urgent patching due to its high CVSS score (8.8), demonstrated exploitability through crafted files, and direct impact on user data confidentiality and integrity. Although local access and user interaction are required, the ubiquity of iOS devices in enterprise environments and the potential for data exfiltration make this a clear priority. The lack of public exploit code (KEV status: not added) provides a narrow window to patch before potential widespread exploitation.

Risk score, explained

The CVSS 3.1 score of 8.8 (High) reflects: (1) network-adjacent attack vector—the attacker can deliver malicious files across network boundaries; (2) low attack complexity—the exploit is straightforward; (3) no privileges required; (4) required user interaction—the user must open the file in Chrome; (5) unchanged scope—the impact is limited to the affected component; and (6) high confidentiality, integrity, and availability impact. The sandbox containment does not reduce the score, as the vulnerability still allows arbitrary code execution and data access within the browser process.

Frequently asked questions