CVE-2026-13893: Chrome WebUI Input Validation Flaw Leaks Cross-Origin Data

Technical summary

CVE-2026-13893 stems from insufficient input validation in Chrome's WebUI layer (Chromium security severity: Medium). The flaw allows a remote, unauthenticated attacker to leak cross-origin data through specially crafted network traffic. The vulnerability is triggered via user interaction and operates within the security context of a single origin (same-site scope), but the validation gap permits unauthorized access to sensitive information across origin boundaries. The attack surface is the network; exploitation requires no special privileges.

Business impact

Organizations deploying Chrome across their workforce face a confidentiality risk, particularly for users handling sensitive or multi-tab browsing scenarios. Data leakage could expose authentication tokens, session identifiers, or confidential business information if an attacker controls the network path or can inject malicious content. Financial services, legal firms, and any organization with strict data governance should prioritize patching. The impact is limited to information disclosure with no integrity or availability loss, but the cross-origin nature of the leak elevates concern for enterprise environments.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. All platforms running vulnerable Chrome versions are at risk: Windows, macOS, Linux, and Chrome on mobile platforms. Organizations should verify their deployed Chrome versions and browser management policies to identify exposure across their estate.

Exploitability

The vulnerability has moderate exploitability. It requires a remote attacker to deliver malicious network traffic and a user to interact with a compromised page or network context. It cannot be exploited passively or without user engagement. Attackers would need to either control a network path the user traverses or compromise a website visited during the attack window. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects the network attack surface, low complexity, required user interaction, and high confidentiality impact. The vulnerability is not currently tracked in the CISA KEV catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will typically deliver the patch within hours to days of release, but manual verification is recommended for critical deployments. Organizations using Chrome Enterprise or Chrome OS should verify patch deployment through their management console. Test the patched version in a controlled environment before mandatory rollout if your organization maintains strict change control.

Patch guidance

Verify Chrome's auto-update status via chrome://help on user machines or through browser management console if available. For Chrome Enterprise deployments, consult your Google Cloud Admin console to confirm version compliance across enrolled devices. Patch should be applied as soon as feasible given the cross-origin data exposure risk. Validate that users running Chrome 150.0.7871.47 or later by checking chrome://version in the address bar.

Detection guidance

Monitor for unusual cross-origin data access patterns in browser logs or endpoint telemetry. Network-based detection is limited because the attack relies on malicious network traffic that may blend with normal browsing. Log all Chrome instances with versions below 150.0.7871.47 and flag for immediate update. If available, use browser telemetry or endpoint detection and response (EDR) tools to detect anomalous WebUI process behavior or suspicious inter-frame communication. Review firewall and proxy logs for traffic patterns consistent with data exfiltration during the window of vulnerability exposure.

Why prioritize this

This vulnerability should be prioritized moderately-high for most enterprises. Although the CVSS score is 6.5 (Medium severity) and user interaction is required, the confidentiality impact is substantial in multi-tab and sensitive-data scenarios. The lack of KEV listing means it is not yet weaponized at scale, but the straightforward network attack vector and lack of special privileges make it an attractive target once weaponization occurs. Chrome's pervasiveness in enterprise environments amplifies risk. Patch within 7-14 days depending on organizational risk tolerance.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a medium-severity vulnerability with high confidentiality impact. The Network attack vector, Low attack complexity, and no privilege requirement indicate accessibility to a broad threat actor base. User interaction is required, which lowers the overall score but does not eliminate risk in realistic scenarios where users are browsing untrusted networks or compromised sites. The unchanged security context (same-site scope) prevents system-wide compromise but permits sensitive data exfiltration. The absence of integrity and availability impact distinguishes this from critical vulnerabilities but the cross-origin data leak is the defining risk.

Frequently asked questions