CVE-2026-13863: Chrome Android CustomTabs Privilege Escalation Vulnerability

Technical summary

CVE-2026-13863 is an input validation flaw (CWE-20) in the CustomTabs implementation of Google Chrome on Android. The vulnerability exists in versions prior to 150.0.7871.47. CustomTabs is a Chrome feature that allows other applications to open web content in a Chrome instance without leaving the parent app. Insufficient validation of untrusted input in this code path permits a local attacker to escalate privileges via a malicious file, bypassing the normal Android sandbox constraints. The Chromium project classified this as Medium severity internally, though the CVSS v3.1 score reflects the practical impact: a local, low-friction attack requiring user interaction that compromises confidentiality, integrity, and availability.

Business impact

Mobile device compromise through this vulnerability could expose sensitive enterprise data stored on or accessible from affected Android devices. If exploited in a BYOD or corporate-managed device context, an attacker gains the ability to read, modify, or delete user data; install persistent malware; or pivot to backend systems accessible from the device. Organizations with Chrome as a primary browser or those where CustomTabs are embedded in business applications face direct risk. The local-only requirement limits opportunistic attacks but doesn't eliminate risk in scenarios involving shared devices, physical device theft, or social engineering.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. The flaw is specific to the Android platform and does not affect Chrome on Windows, macOS, Linux, iOS, or other operating systems. Any application using Chrome's CustomTabs API may be a vector for exploitation if it receives or opens untrusted files that could trigger the vulnerability.

Exploitability

Exploitation requires local device access and user interaction (opening a malicious file), making this a low-sophistication attack from a delivery perspective. An attacker cannot exploit this remotely or without user involvement. However, the attack surface is notable: any mechanism that allows a user to receive, store, or be tricked into opening a file on their Android device—email attachments, messaging apps, file managers, social media, download directories—becomes a potential exploitation vector. Once a user opens the crafted file, no further interaction is required for privilege escalation.

Remediation

Organizations and users must upgrade Google Chrome on Android to version 150.0.7871.47 or later. The patch is available through the Google Play Store and will auto-update on most devices. For managed device environments, administrators should verify that auto-update policies are enabled or push the patch through Mobile Device Management (MDM) solutions. Interim controls include user education on file handling and restricting app permissions where feasible, though these are mitigations rather than solutions.

Patch guidance

Update Chrome on Android to 150.0.7871.47 or newer as soon as feasible. Most users will receive the patch automatically via Google Play; verify your device's Chrome version in Settings > Apps > Chrome > About Chrome. For enterprise environments using MDM, confirm that Chrome is included in auto-update policies. No rollback is necessary if the device is running 150.0.7871.47 or later. Test the patch on a subset of devices before full rollout if your organization uses hardened or custom Android configurations.

Detection guidance

Monitor for attempts to open or access suspicious files through Chrome or applications using CustomTabs, though file-level detection is challenging without forensic access. In managed environments, check device logs for privilege escalation anomalies or unusual process creation following file open events. Security teams should correlate file access patterns with user behavior; unexpected file handling or requests to open files from unknown sources may warrant device inspection. Endpoint Detection and Response (EDR) solutions, if deployed on Android devices, should flag unauthorized privilege elevation events.

Why prioritize this

This vulnerability merits prompt patching despite its local-only attack vector because it provides complete privilege escalation on a widely-used platform. The CVSS score of 7.8 (HIGH) reflects the severity of impact—full compromise of confidentiality, integrity, and availability—even though exploitability is limited by the need for user interaction. Android devices frequently hold sensitive personal and corporate data, and the CustomTabs feature is broadly integrated across Android applications. The lack of complexity and high impact justify rapid deployment.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) is driven by the attack vector (local, AC:L, PR:N), the requirement for user interaction, and the complete impact across all three security properties (C:H, I:H, A:H). While the Chromium project rated this Medium internally, the CVSS vector captures the practical risk: an unauthenticated local attacker can permanently compromise a device and all data on it. The score appropriately reflects that this is not a critical network-exploitable flaw, but a serious local privilege escalation.

Frequently asked questions