CVE-2026-13894: Chrome Navigation Policy Bypass (CVSS 6.5)

Technical summary

This vulnerability stems from insufficient validation of navigation policies in Chrome's network handling code (CWE-602: Client-Side Enforcement of Server-Side Security). When a user visits a crafted HTML page, the browser's policy enforcement mechanisms fail to properly restrict navigation, allowing an attacker to bypass intended browser controls. The attack vector is network-based with low attack complexity, meaning an attacker in a privileged network position—such as on a shared Wi-Fi network, a compromised router, or an ISP-level position—can reliably trigger the bypass without authentication. User interaction is required, reducing opportunistic exploitation but not eliminating it in social engineering or enterprise scenarios.

Business impact

For enterprises, this vulnerability primarily affects integrity controls rather than confidentiality. Users may be redirected to unauthorized sites, credential-harvesting pages, or malicious content despite browser policies intended to block such navigation. In environments with locked-down browser policies (common in regulated industries), this bypass undermines security posture. The requirement for network positioning and user interaction limits mass-scale impact, but organizations with guest Wi-Fi, BYOD programs, or users on untrusted networks face elevated risk. Attackers could use this to socially engineer employees, intercept workflows, or facilitate phishing attacks that policy-restricted browsers would otherwise block.

Affected systems

Google Chrome on Windows, macOS, and Linux systems prior to version 150.0.7871.47 are vulnerable. While the vulnerability description specifies Chrome, the vendor/product data lists multiple operating systems. This reflects that Chrome runs across these platforms and the patch availability depends on the OS-specific Chrome release cycle. Users should verify patch availability for their specific OS-Chrome combination, as macOS and Linux distributions may follow different release schedules.

Exploitability

Exploitation requires network access and user interaction, placing it in the moderate exploitability range. An attacker must be positioned to serve or intercept traffic (man-in-the-middle scenario) and then trick or socially engineer a user into visiting a malicious page. There is no remote code execution, privilege escalation, or data exfiltration—the attacker's goal is to bypass navigation policy to expose the user to secondary attacks. The barrier to exploitation is non-trivial for opportunistic attackers but relatively straightforward for targeted campaigns against employees on unprotected networks. As of publication, there is no evidence of active weaponization (KEV status: not yet included), but the technical mechanics are well-understood given Chrome's open-source nature.

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all affected systems. The patch restores proper policy enforcement in the network layer to prevent policy bypass. Organizations should prioritize updates on systems used by remote workers, BYOD devices, and users accessing sensitive applications, as these cohorts are most exposed to untrusted networks. Verify patch availability through your OS vendor's Chrome channel (official Google releases, Microsoft Store, macOS App Store, or Linux repositories) to ensure you receive the signed, official update.

Patch guidance

Deploy Chrome 150.0.7871.47 or newer via your standard patch management process. On Windows, updates can be enforced through Group Policy (google/policies) or managed through endpoint management platforms. macOS users should update through System Preferences > About or wait for automatic background updates. Linux users should update through their distribution's package manager (apt, yum, etc.). Verify the version number in chrome://settings/help or the About menu after patching. For organizations requiring verified patches, consult Google's official security release notes; do not rely on third-party version announcements.

Detection guidance

Monitor for anomalous browser navigation patterns, particularly to unexpected or policy-restricted domains from users on guest or untrusted networks. While log-level detection of this specific bypass is challenging (it occurs within the browser's rendering engine), behavioral anomalies—such as sudden access to blocked categories or authentication attempts on unintended sites—may indicate compromise or exploitation. Network-level controls (DNS filtering, proxy policies) remain effective as a complementary layer. For incident response, correlate browser policy violations with network telemetry to identify when users on the same network accessed suspicious pages around the same time.

Why prioritize this

CVSS 6.5 (Medium) reflects the integrity-focused impact and requirement for network positioning plus user interaction. However, the vulnerability warrants timely patching because: (1) it directly undermines browser-based security policies in regulated and high-security environments; (2) it's a stepping stone for phishing and social engineering campaigns; (3) Chrome's ubiquity means widespread exposure; and (4) remote workers on untrusted networks are particularly vulnerable. This is not a zero-day emergency requiring out-of-cycle patching, but should be prioritized within your standard patch cycle (1–2 weeks for critical systems, 2–4 weeks for general endpoints).

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is driven by: (1) Network attack vector (AV:N)—attacker must be positioned on the network; (2) Low attack complexity (AC:L)—the crafted HTML is straightforward to construct; (3) No privilege required (PR:N); (4) User interaction required (UI:R)—click or page interaction; (5) No confidentiality impact (C:N)—data is not directly exposed; (6) High integrity impact (I:H)—navigation policy is circumvented; (7) No availability impact (A:N). The score appropriately reflects a policy-bypass vulnerability that enables secondary attacks but does not directly compromise data or availability.

Frequently asked questions