CVE-2026-13868: Chrome Android Site Isolation Bypass (CVSS 6.5)

Technical summary

CVE-2026-13868 is a site isolation bypass vulnerability stemming from inappropriate implementation in Chrome's Network component on Android. Site isolation is a defense-in-depth mechanism that runs each website in its own process, preventing cross-site data theft even if renderer code is compromised. This flaw allows a remote attacker with an already-compromised renderer process to craft a malicious HTML page that circumvents that isolation boundary. The vulnerability is classified as CWE-346 (Origin Validation Error), indicating the issue lies in how the browser validates or enforces origin-based access controls. Chromium's security team rated it Medium severity.

Business impact

While the CVSS score of 6.5 reflects medium severity, the business risk depends on deployment context. For organizations where employees use Chrome on Android devices to access sensitive web applications, a compromised renderer could allow attackers to steal session tokens, credentials, or confidential data from multiple origins simultaneously. The prerequisite of renderer compromise limits immediate exploitation scope, but in targeted scenarios (supply chain attacks, malware-infected devices), this could be a significant stepping stone. Organizations relying on site isolation as part of their defense strategy should treat this as a direct threat to that model.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are vulnerable. Desktop and other platforms are not mentioned in the advisory and should be verified against the official Chromium security releases. Android users of Chrome—whether through the Google Play Store or other distribution channels—are in scope.

Exploitability

Exploitation requires two conditions: the attacker must first compromise the Chrome renderer process (through malware, XSS, or other means), and then craft a specially designed HTML page to trigger the bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network accessibility and low attack complexity, but the renderer compromise prerequisite substantially raises the practical bar. This is not a zero-click vulnerability. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no active, widespread exploitation has been confirmed at time of publication.

Remediation

Update Chrome on Android to version 150.0.7871.47 or later. For organizations managing Android devices via MDM/EMM platforms, push this update across managed Chrome instances. Verify the update through Settings > About Google Chrome, which will display the current version and auto-check for updates.

Patch guidance

Google releases Chrome updates automatically on a regular cadence. End users should ensure automatic updates are enabled in the Play Store. Enterprise administrators can enforce updates via managed Chrome policies or through their MDM solution. Verify patched status by navigating to Chrome settings; the version number should read 150.0.7871.47 or higher. If you maintain internal Chrome deployments or use Chromium-based browsers, cross-reference the official Chromium security releases to confirm equivalent patches are available.

Detection guidance

Detection is challenging without endpoint visibility. Organizations with mobile device management can query enrolled devices for Chrome version numbers to identify unpatched installations. Network-level detection is unlikely to catch this vulnerability, as it manifests through renderer compromise. Monitor for indicators of renderer process compromise (unusual process behavior, unexpected network connections from the browser) using endpoint detection and response (EDR) tools on Android, if available. Log and alert on renderer crashes or security sandbox violations if instrumentation is in place.

Why prioritize this

This vulnerability merits prompt but measured attention. The medium CVSS score and renderer-compromise prerequisite prevent it from being critical, but the threat to site isolation—a foundational Chrome security mechanism—elevates its importance for organizations with high-value Android users. Prioritize patching for devices that access financial services, email, cloud collaboration tools, or other sensitive web applications. Delay is acceptable if your deployed Chrome versions are already at 150.0.7871.47 or later, but make it part of your regular patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects high integrity impact (I:H) but no confidentiality or availability impact. The score weights network accessibility and low attack complexity favorably, but the need for renderer compromise and user interaction prevents a higher rating. The integrity impact is significant because a compromised renderer can now alter or exfiltrate data across site boundaries; the absence of confidentiality impact in the vector may understate real-world risk if data theft is the attacker's goal. Organizations heavily invested in Android should consider their specific threat model when deciding whether this warrants expedited patching.

Frequently asked questions