CVE-2026-13866: Chrome Android Site Isolation Bypass – Update to 150.0.7871.47

Technical summary

CVE-2026-13866 is an input validation weakness (CWE-20) in Google Chrome on Android versions prior to 150.0.7871.47. The vulnerability exists in the browser's input handling mechanism and allows an attacker with an already-compromised renderer process to craft an HTML page that defeats site isolation—the architectural boundary that confines each website's process to prevent cross-site data access. The attack requires network access and user interaction (clicking a link or visiting a page), but no authentication. The Chromium security team rated this as Medium severity.

Business impact

For organizations deploying Chrome on Android devices, this vulnerability creates a multi-stage attack scenario. While it requires a renderer compromise first, successful exploitation could lead to one-click lateral movement between websites within the same Chrome session, potentially exposing authentication cookies, cached data, or sensitive information from multiple origins. For businesses relying on Chrome's sandboxing guarantees for sensitive operations on mobile devices, this weakens the defense-in-depth posture and increases the effective impact of other browser vulnerabilities.

Affected systems

Google Chrome on Android versions before 150.0.7871.47 are affected. Desktop Chrome and Chrome on other platforms are not mentioned in the advisory. Android users running older Chrome builds should prioritize updates. Enterprise deployments using Chrome on Android for work-related browsing face the highest exposure.

Exploitability

This vulnerability has a low immediate exploitability barrier in terms of network requirements and user interaction—any remote attacker can serve the malicious HTML page. However, it is fundamentally a post-compromise weakness: an attacker must have already successfully exploited a separate vulnerability to take control of the Chrome renderer process. It is not a direct entry point. The attack does not appear in CISA's Known Exploited Vulnerabilities catalog, indicating no observed in-the-wild exploitation at publication time.

Remediation

Users should update Google Chrome on Android to version 150.0.7871.47 or later immediately. This patch closes the input validation flaw and restores the integrity of site isolation. For organizations managing Android devices, enable automatic Chrome updates or use Mobile Device Management (MDM) policies to enforce the minimum patched version. No workarounds exist beyond updating.

Patch guidance

Update Chrome on Android to version 150.0.7871.47 or later. Verify the update through the Google Play Store (Settings > About Chrome > Update) or confirm the version in Chrome's About section. Organizations managing fleet deployments should use MDM policies to enforce this minimum version across all Android devices. Verify the patch is in place within 30 days of availability to limit the window during which a renderer compromise could be chained with this input flaw.

Detection guidance

Detection of exploitation is indirect, as it requires prior renderer compromise. Monitor for: (1) unusual cross-origin data exfiltration or cookie access within Chrome sessions; (2) unexpected crashes or process terminations (site isolation failures may trigger sandbox exceptions); (3) suspicious HTML elements or script execution in web traffic logs; (4) successful exploitation of known renderer vulnerabilities (e.g., memory corruption bugs) that might be chained with this flaw. Endpoint detection and response (EDR) tools on Android devices should alert on renderer process crashes or abnormal memory access patterns.

Why prioritize this

This is a Medium-severity chained vulnerability requiring prior renderer compromise, not a direct attack vector. Prioritize patching on devices handling sensitive data or used in high-security roles, but also ensure broad coverage to prevent opportunistic chaining attacks. Its presence on Android—a high-volume mobile platform—justifies rapid rollout, especially in organizations where employees use personal or corporate Chrome on Android for work access.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects attack complexity (requires prior compromise), user interaction (crafted page must be visited), and the lack of availability impact. The integrity impact is rated High because successful exploitation can expose data across site boundaries. The absence of confidentiality impact in the vector indicates the vulnerability itself does not directly leak information, but rather removes isolation that would prevent information gathering by the already-compromised renderer.

Frequently asked questions