CVE-2026-13856: Chrome Android Speech API Privilege Escalation – Patch Now

Technical summary

CVE-2026-13856 is a privilege escalation flaw in the Speech API implementation within Google Chrome for Android. The vulnerability stems from insufficient input validation in the Speech module when handling untrusted data. An attacker who has already gained code execution in the renderer process can craft a malicious HTML page that exploits this validation gap to escape renderer sandbox restrictions and achieve higher privilege levels. The attack vector is network-based, requiring user interaction (visiting the malicious page), but assumes prior renderer compromise. Chromium assessed this as medium severity internally, though the CVSS v3.1 score of 7.5 reflects the high impact potential if successfully exploited.

Business impact

For organizations deploying Chrome on Android devices—whether personally-owned or corporate-managed—this vulnerability represents a chaining risk in advanced attack scenarios. While the initial renderer compromise is a prerequisite, successful exploitation could lead to full device compromise, enabling attackers to access sensitive data, install persistent malware, or pivot to corporate networks if the device has access credentials. The practical risk depends on your threat model: devices handling sensitive information or used by high-value targets warrant faster remediation. Consumer users face lower direct risk unless targeted, but the vulnerability highlights the importance of timely patching in a mobile environment where updates are often delayed.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. The vulnerability is specific to Chrome on Android; desktop versions of Chrome are not mentioned in the advisory. Any Android device running an older Chrome version is potentially vulnerable if a user is exposed to a crafted page after renderer compromise occurs. The Android OS itself is not directly vulnerable; the issue is in Chrome's Speech feature implementation.

Exploitability

Exploitation requires a high level of attacker sophistication and a two-stage compromise: first, the attacker must already have code execution in Chrome's renderer process (via a separate vulnerability or attack), and second, the victim must visit a crafted HTML page while that renderer compromise is active. This significantly raises the bar for widespread exploitation. The vulnerability is not being actively exploited in the wild according to available intelligence (KEV status is false), and no public proof-of-concept has been disclosed. Opportunistic attacks are unlikely; targeted campaigns against high-value individuals or organizations are the primary concern.

Remediation

Update Google Chrome on affected Android devices to version 150.0.7871.47 or later immediately. Users can check their current version in Chrome settings under 'About Chrome,' where the app will offer an update if a newer version is available. For organizations managing Android devices via Mobile Device Management (MDM), deploy the update through your management console to ensure compliance. No workarounds are available; patching is the only mitigation. If you cannot update immediately due to compatibility constraints, consider restricting Chrome usage on sensitive devices until patching is complete.

Patch guidance

Install Chrome version 150.0.7871.47 or later on all Android devices in your environment. Google Chrome on Android auto-updates by default, but users should manually check Settings > About Chrome to trigger the update if it has not arrived automatically. Enterprise deployments should verify update rollout through their MDM platform and confirm patch application across their fleet. No reboot is required after updating Chrome. Test the update on a representative device first if your organization has custom Chrome configurations or extensions.

Detection guidance

Monitor Chrome version numbers on Android devices in your fleet using endpoint detection and response (EDR) tools or MDM reporting. Identify any devices running Chrome versions below 150.0.7871.47 and flag them for urgent patching. If you suspect a renderer compromise has occurred on a device (unusual crashes, unexpected network activity from Chrome, or successful infection from a different browser vulnerability), isolate the device and examine Chrome crash reports and system logs for anomalies. Look for signs of post-renderer-compromise activity such as new user accounts, unexpected privilege grants, or suspicious processes running with elevated rights.

Why prioritize this

Although this vulnerability carries a high CVSS score (7.5) and serious impact potential, its practical exploitability is constrained by the prerequisite renderer compromise. Organizations should prioritize patching based on device sensitivity and threat exposure: high-priority for devices used by executives, government officials, or for handling classified information; standard priority for general enterprise fleets. The vulnerability's absence from the KEV catalog and lack of active exploitation lower urgency compared to zero-day threats, but timely patching within your normal update cycle (weeks, not months) is still warranted given the potential for privilege escalation.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects the serious consequences of successful exploitation—complete compromise of confidentiality, integrity, and availability—combined with a reasonable attack complexity. The score assumes a network attack vector and user interaction (clicking a link or visiting a page), but does not fully weight the prerequisite renderer compromise, which significantly narrows the real-world attack surface. The gap between Chromium's internal 'medium' severity rating and the CVSS 'HIGH' rating underscores that CVSS measures impact, not exploitability likelihood. Your actual risk is lower than 7.5 suggests unless your organization faces advanced threats capable of first-stage renderer compromises.

Frequently asked questions