CVE-2026-13889: Chrome iOS WebAuthentication Side-Channel Data Leak (CVSS 6.5)

Technical summary

CVE-2026-13889 is a side-channel information leakage vulnerability in the WebAuthentication implementation within Google Chrome for iOS. The vulnerability permits a remote attacker to extract cross-origin data by serving a crafted HTML page to a victim. The attack vector is network-based with low attack complexity, requires user interaction (visiting a malicious page), and does not require authentication or special privileges. The vulnerability has been assigned CVSS 3.1 score 6.5 (Medium severity) with high confidentiality impact but no integrity or availability impact. The underlying weakness is classified under CWE-20 (Improper Input Validation).

Business impact

For organizations with iOS-based workforces, this vulnerability poses a credential and sensitive data theft risk. Users accessing web applications from Chrome on iOS—particularly those using WebAuthn for authentication—may have authentication credentials or sensitive session data exposed to attackers who can redirect traffic or inject malicious content. The impact is elevated in environments where authentication tokens or personally identifiable information are processed through web-based workflows. Secondary risks include account compromise and unauthorized access to protected resources.

Affected systems

The vulnerability affects Google Chrome on iOS in versions prior to 150.0.7871.47. The attack surface is limited to iOS devices running vulnerable Chrome builds; desktop and Android Chrome versions are unaffected. Systems running Chrome 150.0.7871.47 and later, as well as users on other browsers (Safari, Firefox, etc.), are not vulnerable to this specific flaw.

Exploitability

Exploitation requires delivering a crafted HTML page to a victim user who must visit the malicious site while using Chrome on iOS. No special user interaction beyond navigation is needed, and the attack requires no prior authentication or elevated privileges. The low attack complexity and network attack vector make this reasonably exploitable in real-world scenarios where users can be directed to malicious content (phishing, watering hole, malvertising). However, no evidence of active exploitation exists in the wild at this time, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Users and administrators should update Google Chrome on iOS to version 150.0.7871.47 or later. Verify the update through the App Store's update notification or by checking Chrome's About page. For organizations managing iOS devices, mobile device management (MDM) solutions can be configured to enforce automatic updates or restrict Chrome to compliant versions. Organizations relying on WebAuthn for authentication should ensure all supported browsers and platforms are kept current.

Patch guidance

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store. Users can verify the fix by navigating to Chrome Settings > About Chrome, which will display the current version and automatically prompt for updates if a newer version is available. For enterprise environments, coordinate with IT teams to validate availability of the patch in your app distribution channels before rolling out to end users. No workarounds exist; patching is the primary remediation.

Detection guidance

Monitor for successful Chrome updates on iOS devices through MDM logs or app inventory tools to confirm compliance. Web application and authentication logs should be reviewed for anomalous cross-origin requests or session hijacking attempts originating from iOS Chrome clients, though side-channel attacks may leave minimal audit trails. Network-based detection is difficult without encrypted traffic inspection; focus on endpoint-level verification that vulnerable Chrome versions have been retired from production devices. If WebAuthn is in use, validate that authentication flows complete only from expected origins and device types.

Why prioritize this

Although unassigned to CISA's Known Exploited Vulnerabilities list, this vulnerability warrants prompt attention in iOS-heavy environments. The combination of low attack complexity, user interaction requirement, and high confidentiality impact creates a meaningful risk for credential theft and data exfiltration. Organizations processing sensitive authentication or identity data through Chrome on iOS should prioritize updates within standard patch windows. Lower urgency than critical or high-severity flaws, but should not be deferred beyond routine update cycles.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a Medium severity rating. The high confidentiality impact (leakage of cross-origin data) is balanced against the requirement for user interaction and the absence of integrity or availability impact. The network attack vector and low complexity increase exploitability, but the need to deliver a crafted page to a specific victim limits large-scale automated attacks. The score appropriately captures a meaningful but not critical threat profile.

Frequently asked questions