CVE-2026-13886: Google Chrome Content Security Policy Bypass in Isolated Web Apps

Technical summary

CVE-2026-13886 stems from insufficient policy enforcement in Chrome's Isolated Web Apps (IWAs) feature. The vulnerability exists in the Content Security Policy (CSP) implementation for IWAs, a sandboxed web application model. An attacker can craft a specially designed HTML page that exploits a logic flaw in policy validation, permitting script execution or content injection that should be blocked by CSP directives. The issue is classified as CWE-693 (Improper Protection of Alternate Path), indicating a bypass of an intended security control. Chromium's severity assessment is Medium, reflecting the requirement for user interaction and the integrity-focused impact.

Business impact

A successful exploit could allow attackers to inject malicious content into Isolated Web Apps running in Chrome, potentially compromising the integrity of displayed information or application state. Organizations relying on IWAs for internal tools, progressive web applications, or sensitive workflows should consider this a supply-chain risk—especially if users can be socially engineered into visiting attacker-controlled pages. Data confidentiality is not directly at risk, but integrity and availability of app functionality are. The attack requires no special network positioning, making it accessible to a broad threat actor population with the ability to host content.

Affected systems

This vulnerability affects Google Chrome on all supported operating systems: macOS, Linux, and Windows. Specifically, any Chrome version prior to 150.0.7871.47 is vulnerable. The vulnerability is isolated to Chrome; other Chromium-based browsers (Edge, Opera, Brave) are not listed in the vendor product set and should be checked against their own release notes. Users on earlier stable, beta, or dev channels remain at risk until they update. Chrome's auto-update mechanism should deliver patches, but corporate-managed instances with delayed rollouts require manual verification.

Exploitability

Exploitation is straightforward in terms of mechanics: an attacker needs only to host a malicious HTML page and convince a user to visit it (via phishing, watering hole, or social engineering). No authentication bypass, no local code execution prerequisite, and no complex multi-step chaining is necessary. The barrier is primarily social engineering rather than technical difficulty. However, the scope is limited to Isolated Web Apps—standard web browsing in a normal Chrome tab is not directly affected by this bypass. Exploit difficulty is low, likelihood of weaponization is moderate, and public exploit code is not yet present in the record, but proof-of-concept disclosure should be expected following widespread patching.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For macOS, Windows, and Linux users, Chrome's automatic update mechanism should deploy the patch; verify the version in chrome://version. Organizations managing Chrome through mobile device management (MDM) or group policy should push the update via their deployment channels. For users unable to update immediately, disable Isolated Web Apps if they are not essential to workflows, or restrict navigation to untrusted sites until patching is complete. No interim workarounds exist that fully mitigate the CSP bypass without patching.

Patch guidance

Google released Chrome 150.0.7871.47 to address this vulnerability. Patch deployment varies by platform: auto-update users will receive the patch automatically over the next few days; users can force update via Chrome menu > Help > About Google Chrome. Enterprise deployments should reference the Chrome release notes and verify successful rollout via device inventory or reporting tools. Version 150.0.7871.47 is the minimum safe version; newer versions also contain the fix. Test the patch in a non-production environment for any Isolated Web App integrations before full deployment. If you operate IWA-dependent services, coordinate with affected users to ensure timely updates.

Detection guidance

Detection is primarily behavioral and requires monitoring user interactions with Isolated Web Apps. Log attempts to load IWAs from unexpected or attacker-controlled sources. Monitor Chrome crash reports and error logs for CSP violations or policy enforcement failures in IWA contexts. Network detection is limited since the attack occurs within the browser; however, monitoring for users visiting newly registered domains or suspicious URLs and then accessing IWAs may surface attacks. Endpoint agents capable of Chrome telemetry can flag policy bypass events. If you host IWAs, monitor for unusual request patterns or content injection attempts in application access logs. Consider user awareness training to reduce the likelihood of clicking malicious links targeting IWA users.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 6.5 (Medium) and lack of CISA KEV listing indicate a measured risk level. However, the low barrier to exploitation and reliance on user interaction alone—without authentication or local access—means that widespread attacks are plausible once public details emerge. Organizations with Isolated Web App deployments should prioritize this above standard updates. Non-IWA users can treat this as routine patching, but should not defer indefinitely. The 2-3 week window between publication and broad active exploitation is typical; patching within that window is recommended.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects an exploitable vulnerability with a network attack vector, low complexity, no privilege requirement, and user interaction. The primary impact is integrity (high), while confidentiality and availability are not affected, yielding the Medium severity rating. The scope is unchanged (impact is limited to the affected component, not the system broadly). The score fairly represents the risk: not a critical remote code execution, but a tangible security flaw affecting policy enforcement. The lack of KEV designation suggests CISA has not yet observed active in-the-wild exploitation, lowering the immediate urgency but not eliminating the need for timely patching.

Frequently asked questions