CVE-2026-13896: Google Chrome Navigation Bypass Vulnerability (Glic Component) – Patch v150.0.7871.47

Technical summary

CVE-2026-13896 is an insufficient policy enforcement vulnerability in Chrome's Glic component. The flaw stems from inadequate validation or enforcement of navigation restriction policies, mapped to CWE-602 (Client-Side Enforcement of Server-Side Security). An attacker can craft a malicious HTML document that, when loaded in a vulnerable Chrome browser, bypasses the browser's intended navigation controls. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates network attack surface, low attack complexity, user interaction requirement, and high integrity impact—meaning the attacker can modify or redirect navigation flows. Chromium assigned this a Medium security severity rating.

Business impact

Navigation bypass vulnerabilities create risks of credential harvesting, malware distribution, and user misdirection. An attacker could redirect authenticated users away from legitimate applications to phishing sites, inject malicious content into expected workflows, or manipulate finance and commerce transactions by intercepting or altering navigation flows. For organizations relying on Chrome as a corporate browser, this expands the attack surface for social engineering campaigns. The need for user interaction limits mass exploitation but does not eliminate risk in targeted scenarios or when combined with phishing.

Affected systems

Google Chrome for Windows, macOS, and Linux are impacted in versions prior to 150.0.7871.47. The Linux kernel, macOS, and Windows are listed in the affected platforms, but the vulnerability is specific to the Chrome application component, not the operating systems themselves. Organizations standardizing on Chrome across multiple platforms should prioritize updates across all endpoints.

Exploitability

Exploiting this vulnerability requires a user to visit or interact with a crafted HTML page—there is no remote code execution, no zero-click attack, and no requirement for attacker privileges. The low attack complexity and network attack vector make it straightforward for an attacker to host a malicious page or embed it in emails and advertisements. However, user awareness and safe browsing habits provide a practical control layer. The vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not been widely observed at the time of publication.

Remediation

Users and administrators must update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism typically delivers patches within hours of release, but manual verification in Settings > About Google Chrome ensures compliance. Organizations managing Chrome at scale should use Chrome Enterprise policies to enforce minimum version requirements and block older builds. Testing should confirm that navigation-dependent workflows (iframe policies, CSP directives, and cross-origin navigation) continue functioning after patching.

Patch guidance

Verify Chrome version via Settings > About Google Chrome, which will automatically check for updates. The patched version is 150.0.7871.47 or later. For managed deployments, administrators should set the MinimumChromeVersion policy and monitor rollout progress via Admin Console dashboards. No backward compatibility issues are documented, and the patch is marked as a routine security update rather than a breaking change. Plan updates within standard maintenance windows; user disruption is minimal as Chrome typically restarts after update installation.

Detection guidance

Monitor for users on Chrome versions prior to 150.0.7871.47 using endpoint management tools or browser telemetry integrations. Within Chrome, Safe Browsing may flag some malicious pages used in exploitation, but proactive version tracking is more reliable. Network-level detection is limited since the attack relies on legitimate HTTP/HTTPS traffic; focus detection efforts on user behavior anomalies (unexpected redirects, permission prompts, or navigation warnings). Security teams should alert users to be cautious with links in emails or unfamiliar websites and review authentication logs for accounts accessed from unexpected contexts immediately after navigation anomalies.

Why prioritize this

Prioritize this patch at medium urgency. The CVSS score of 6.5 reflects moderate risk, and the vulnerability is not yet weaponized at scale (no KEV listing). However, the network attack surface, low complexity, and requirement only for user interaction make it a practical target for phishing and social engineering campaigns. Organizations with high-risk user populations (finance, legal, healthcare) or those in industries targeted by threat actors should accelerate patching. Desktop Chrome deployments are more critical than mobile in this context, as the attack vector most naturally applies to users following links in email or browsing untrusted content.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) balances moderate threat attributes: network reachability and low attack complexity against the requirement for user interaction and absence of information disclosure or availability impact. The high integrity impact (attackers can redirect or manipulate navigation) drives the score higher than purely informational flaws. The fact that no privileges are required and the attack succeeds over the network positions this above low-severity issues. However, the reliance on user action and the lack of remote code execution prevent it from reaching high severity (7.0+). For organizations with stringent security postures, a localized risk assessment may warrant treating this as high priority despite the medium CVE score, especially if users frequently visit untrusted sites or click external links.

Frequently asked questions