CVE-2026-13892: Chrome iOS Cross-Origin Data Leak via UI Gesture Exploitation

Technical summary

CVE-2026-13892 stems from an inappropriate implementation in Chrome's iOS rendering engine related to cross-origin data handling. The vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information) and requires user interaction: a remote attacker must craft a malicious HTML page and convince a user to perform specific UI gestures (such as taps or swipes) to trigger data leakage. The attack vectors involve manipulating the browser's UI presentation to trick users into actions that bypass normal same-origin policy protections. Once triggered, the flaw exposes sensitive cross-origin data that should be isolated by the browser's security model.

Business impact

For organizations with iOS users accessing sensitive web applications or internal portals, this vulnerability introduces a targeted risk. An attacker could harvest authentication tokens, session cookies, personal information, or proprietary data from one domain while the user is interacting with a malicious site. The impact scales with how many of your users rely on Chrome for iOS to access confidential resources. Although exploitation requires user interaction and a crafted page, the barrier to launching such attacks is relatively low—no special privileges, no complex network manipulation. Companies with strict data classification policies should treat unauthorized cross-origin data disclosure as a material incident risk.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are vulnerable. Because Chrome on iOS is built on Apple's WebKit engine under iOS platform constraints, this affects iPhone and iPad users running affected Chrome versions. Organizations should inventory Chrome deployments on iOS devices, especially among employees accessing sensitive services. Users of Chrome on other platforms (Windows, macOS, Linux, Android) are not affected by this specific flaw.

Exploitability

Exploitation requires a remote attacker to host a crafted HTML page and socially engineer a user into visiting it and performing specific UI gestures—such as intentional taps, long-presses, or swipes on attacker-controlled elements. There is no indication this vulnerability has been exploited in the wild (KEV status: not listed). The attack does not require the user to be logged into the target site beforehand; the attacker can attempt to exfiltrate data from any cross-origin domain the user has recently visited or has cached credentials for. Phishing campaigns, malicious advertisements, or social engineering could serve as delivery vectors.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users should enable automatic app updates in the App Store to receive patches promptly. Organizations managing iOS devices via Mobile Device Management (MDM) solutions should push Chrome updates through their deployment channels. Until patching is complete, educate users to avoid clicking links from untrusted sources and to be cautious when prompted to perform unusual UI interactions on unfamiliar websites.

Patch guidance

Users can verify their Chrome version by opening Chrome, tapping the menu (three horizontal lines), selecting 'Settings,' then 'About Chrome.' The app will display the current version and automatically check for updates. On managed iOS devices, verify that your MDM policy enforces the minimum Chrome version 150.0.7871.47 or later. Test the update on a pilot group of devices before full rollout to ensure compatibility with your internal applications and workflows.

Detection guidance

Monitor for Chrome version compliance on iOS devices using your MDM console or mobile threat defense platform. Detection of active exploitation is difficult because the attack relies on user interaction rather than network anomalies; however, behavioral signals include users reporting unexpected data access, session hijacking attempts, or unusual account activity shortly after visiting suspicious links. Consider blocking known malicious phishing domains at the network level and implementing conditional access policies that restrict cross-origin cookie access in sensitive environments.

Why prioritize this

This is a medium-severity issue that warrants near-term patching but is not critical. The CVSS score of 6.5 reflects moderate impact (high confidentiality exposure, no integrity or availability risk) combined with low attack complexity and the requirement for user interaction. It should be prioritized above routine updates but below critical RCE or authentication bypass flaws. Organizations with large iOS user bases or strict data protection requirements should accelerate patching; smaller deployments can integrate the update into their standard monthly cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is derived from: Attack Vector: Network (AV:N) — attacker can exploit remotely via crafted HTML; Attack Complexity: Low (AC:L) — no special conditions required; Privileges Required: None (PR:N) — no authentication needed; User Interaction: Required (UI:R) — user must perform specific gestures; Scope: Unchanged (S:U) — impact limited to the vulnerable component; Confidentiality: High (C:H) — sensitive cross-origin data is exposed; Integrity: None (I:N); Availability: None (A:N). The presence of user interaction prevents a higher score despite the full confidentiality impact.

Frequently asked questions