CVE-2026-13881: Chrome Same-Origin Policy Bypass in WebAppInstalls

Technical summary

CVE-2026-13881 is a same-origin policy (SOP) bypass vulnerability in Chrome's WebAppInstalls implementation. The flaw stems from inappropriate handling of web app installation flows, allowing an attacker-controlled page to circumvent origin restrictions via crafted HTML. The vulnerability maps to CWE-346 (Origin Validation Error), indicating a failure in proper origin verification during the web app installation process. The CVSS 3.1 score of 6.5 (Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects network-based attack delivery, low complexity, no privileges required, user interaction needed, and high integrity impact with no confidentiality or availability impact.

Business impact

A successful exploit could allow attackers to manipulate how web applications behave within the browser context, potentially leading to unauthorized data modification, cross-origin data exfiltration, or privilege escalation within installed web apps. For organizations relying on Chrome-based web applications or progressive web apps (PWAs), this could result in data integrity breaches, session compromise, or unauthorized actions performed on behalf of users. The requirement for user interaction (clicking a malicious link or visiting a crafted page) limits but does not eliminate risk, especially in phishing or supply chain scenarios.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable across all major operating systems: Windows, macOS, and Linux. The scope includes any user or organization running an unpatched version of Chrome. PWA users and enterprises deploying Chrome-based productivity applications face direct exposure.

Exploitability

Exploitation requires user interaction—the victim must visit a crafted HTML page or click a malicious link. No special privileges or complex conditions are needed; network access is sufficient. The attack complexity is low, making it straightforward for an attacker to deliver the payload via email, watering-hole attacks, or malvertising. Active exploitation is not currently widespread (vulnerability is not on CISA's Known Exploited Vulnerabilities catalog), but the low barrier to weaponization warrants prompt patching.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Users should enable automatic updates in Chrome settings (Settings > About Chrome) to receive patches automatically. For managed environments, deploy Chrome updates through your organization's patch management system to ensure uniform coverage across all endpoints.

Patch guidance

Verify that all Chrome installations have been updated to version 150.0.7871.47 or later. Check via Chrome menu > Settings > About Chrome; the browser will report its current version and automatically download available updates. For enterprise deployments, use Google Chrome Enterprise Bundle or your endpoint management platform to verify and enforce the patched version across your fleet. Test web applications and PWAs post-update to confirm functionality remains intact.

Detection guidance

Monitor for successful installation or attempted installation of suspicious web apps via Chrome's WebAppInstalls feature. Examine browser logs and security event data for anomalous cross-origin requests initiated during or after web app installation. Watch for unusual user reports of web app behavior or unexpected permission grants. Network-level detection is limited; rely on endpoint logs and Chrome sync diagnostics if available in your environment.

Why prioritize this

This vulnerability warrants medium-to-high priority patching due to the combination of low attack complexity, user-interaction requirement (not a showstopper in phishing scenarios), and moderate integrity impact. The breadth of affected platforms and reliance on Chrome in enterprise environments means delayed patching increases risk exposure. While not currently actively exploited, the straightforward attack vector and high integrity impact make it an attractive target for determined adversaries.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a medium-severity flaw. Network-based delivery (AV:N) and low attack complexity (AC:L) make exploitation accessible. User interaction (UI:R) is required but realistic in targeted campaigns. The high integrity impact (I:H) indicates an attacker can modify or corrupt data in the victim's context. Lack of confidentiality loss (C:N) and availability impact (A:N) prevents a higher score, but the integrity threat alone justifies urgent remediation.

Frequently asked questions