CVE-2026-13862: Chrome iOS Web Authentication Cross-Origin Data Leak

Technical summary

CVE-2026-13862 stems from insufficient policy enforcement in the Web Authentication API implementation on Chrome for iOS. The vulnerability allows an attacker in a network position to conduct cross-origin data leakage attacks via a specially crafted HTML page. The flaw relates to improper handling of security policies governing passkeys and security key interactions, enabling unauthorized access to sensitive data across different origins. This is classified under CWE-693 (Improper Protection of Alternate Path) and carries a CVSS 3.1 score of 6.5 (Medium severity) with a vector indicating network-based attack, low attack complexity, no privilege requirement, but requiring user interaction with confidentiality impact.

Business impact

The primary risk is unauthorized disclosure of confidential user data spanning multiple websites. For organizations relying on Chrome on iOS for secure authentication workflows, this vulnerability could compromise user privacy and data isolation guarantees. An attacker with network access could potentially harvest session tokens, personal information, or authentication credentials displayed across multiple browser contexts. While the attack requires both network positioning and user action, the high confidentiality impact makes this a concern for enterprises managing sensitive mobile workflows, particularly those with users on shared or untrusted networks.

Affected systems

This vulnerability affects Google Chrome on iOS versions prior to 150.0.7871.47. The issue is specific to the iOS platform and does not affect Chrome on other operating systems based on the description. As Chrome on iOS relies on Apple's WebKit engine, the underlying iOS version may also be relevant, though the vulnerability is attributed to Chrome's policy enforcement layer rather than iOS itself. Users running affected versions should prioritize upgrading.

Exploitability

The attack requires three conditions: an attacker must occupy a privileged network position (such as controlling a WiFi network or intercepting traffic), a user must visit a malicious webpage controlled by the attacker, and the user must interact with web authentication features or click on crafted elements. While network positioning raises the bar, WiFi-based attacks and compromised network segments are feasible in real-world scenarios. The requirement for user interaction prevents fully automated exploitation, but social engineering or drive-by compromise can lower this barrier. This is not a zero-click vulnerability, reducing but not eliminating the practical risk.

Remediation

Users must upgrade Google Chrome on iOS to version 150.0.7871.47 or later. This is a mandatory security update that fixes the policy enforcement gap in Web Authentication handling. No workarounds are available; patching is the only mitigation. Organizations should prioritize pushing this update to iOS devices, particularly those connecting to untrusted networks. Consider requiring Chrome updates as part of mobile device management policies.

Patch guidance

Apply Google Chrome version 150.0.7871.47 or later on all iOS devices. Verify the update through the App Store, as Chrome auto-updates may be delayed depending on device settings. For enterprises deploying Chrome via Mobile Device Management, push the update immediately through your MDM solution. Test the patched version in a non-production environment if you have custom web authentication integrations. After patching, confirm the version string in Chrome Settings > About Google Chrome to ensure the update was applied.

Detection guidance

Detection of active exploitation is challenging without network-level monitoring. Monitor for unusual cross-origin data access patterns in web server logs if you host authentication endpoints. Watch for unexpected user complaints about authentication issues on iOS specifically, which could indicate attempted exploitation. Endpoint Detection and Response (EDR) tools with iOS support can monitor for suspicious network activity from Chrome. If you control network infrastructure, monitor for patterns of users simultaneously connecting to authentication pages and attacker-controlled content. Consider vulnerability scanning to identify devices still running Chrome versions prior to 150.0.7871.47.

Why prioritize this

Although rated Medium severity, this vulnerability warrants prompt attention because it directly affects the confidentiality of cross-origin data—a core security boundary in web browsers. The combination of network-based delivery and user interaction requirements prevents this from being critical, but the proven ability to leak sensitive data makes it more serious than the CVSS suggests for organizations with strict data protection requirements. The iOS-specific nature means patching is essential for mobile-first organizations. Prioritize this in your patch cycle, aiming for deployment within 2–3 weeks for critical systems, sooner if users handle highly sensitive data on shared networks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the confluence of factors: network-based attack vector, no special privileges required, but crucially, user interaction required (reducing exploitability) and confidentiality impact only (no integrity or availability impact). The score does not account for the attacker's need for a privileged network position, which is difficult but achievable in practice. This explains why the base score lands in Medium territory rather than High—the barriers to exploitation are meaningful but not insurmountable. For organizations with elevated security postures, the real-world risk may warrant treating this as higher priority despite the numerical rating.

Frequently asked questions