CVE-2026-13904: Google Chrome iOS Safe Browsing Bypass Vulnerability

Technical summary

CVE-2026-13904 is an implementation defect in the Safe Browsing module of Google Chrome for iOS prior to version 150.0.7871.47. The vulnerability stems from improper enforcement of navigation restrictions (CWE-693: Improper Protection of Alternate Path), permitting a network-based attacker to construct a crafted HTML page that circumvents Safe Browsing's ability to block navigation to known dangerous URLs. The attack vector is network-accessible, requires minimal complexity, and depends on user interaction to trigger the bypass. No special privileges are necessary.

Business impact

This vulnerability undermines Chrome's primary defense against phishing and malware distribution on iOS. Users who are tricked into visiting an attacker's page may then be redirected to sites hosting credential theft schemes, malware, or exploit kits without Chrome's warning system intervening. For organizations relying on Chrome as a primary browser, this increases the risk that employees will be successfully compromised by web-based attacks. The impact is primarily to information integrity (users are misdirected) rather than confidentiality or availability.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are vulnerable. This includes all Apple iPhone OS devices running affected Chrome releases. Android or desktop Chrome versions are not mentioned in this advisory and are presumed unaffected by this specific flaw. The vulnerability is specific to the iOS implementation of Safe Browsing.

Exploitability

Exploitation is practical but not automated. An attacker must host a malicious HTML page and entice a user to visit it—typically through phishing email, malicious advertisement, or social engineering. Once a user lands on the attacker's page, the bypass occurs without further interaction. No browser configuration changes or system compromise are prerequisites. However, targeted campaigns would be required to reliably exploit this at scale, limiting widespread opportunistic abuse.

Remediation

Users and administrators should update Google Chrome for iOS to version 150.0.7871.47 or later. Apple's App Store distribution mechanism means updates will be offered automatically; users should accept them promptly. Organizations managing iOS devices via MDM should ensure Chrome is kept current via their management policies. No workaround short of disabling Chrome or patching is available.

Patch guidance

Verify the installed version of Chrome on iOS by opening the app, navigating to Settings, and checking the version number against 150.0.7871.47. Updates typically deploy via the App Store within 24–48 hours of release. If auto-update is disabled, manually open the App Store and update Chrome. Enterprise users managing devices via MDM (Mobile Device Management) should configure policies to enforce automatic app updates or schedule a staged rollout to ensure compliance. Verify post-patch by checking the version number again.

Detection guidance

Monitor for evidence of users visiting suspicious external domains or HTML pages designed to bypass Safe Browsing. Network detection is limited by iOS encryption; visibility typically comes through user reports, endpoint telemetry if available, or browser history review. Organizations can educate users on recognizing phishing pages that claim to bypass browser safety. Log Chrome crash reports or Safe Browsing bypass attempts if logging is configured. In enterprise contexts, monitor for unusual navigation patterns or access to known malicious domains that Safe Browsing should have blocked.

Why prioritize this

Although the CVSS score is Medium (6.5), this vulnerability directly weakens a core security feature relied upon by millions of iOS users. The attack surface is broad (any user can be targeted via a crafted web page), and the barrier to exploitation is low. Patching should be prioritized because Safe Browsing is the primary in-browser defense against phishing and malware on iOS, and compromising it erodes user protection across the entire web.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible vulnerability with low attack complexity, requiring only user interaction, with high impact to integrity (Safe Browsing bypass) but no direct impact to confidentiality or availability. The score accurately captures that this is a bypass of a protective control rather than a direct system compromise. Organizations should not underestimate the risk based on the Medium rating; the vulnerability's functional impact—circumventing anti-phishing protection—may warrant urgent patching despite the numerical score.

Frequently asked questions