CVE-2026-13908: Chrome iOS Omnibox Navigation Bypass (CVSS 6.5)

Technical summary

CVE-2026-13908 stems from insufficient input validation in Chrome's Omnibox component on iOS. The vulnerability resides in how the browser validates and processes navigation requests triggered by user gestures combined with attacker-controlled network responses. By crafting malicious network traffic synchronized with specific UI interactions, an attacker can circumvent navigation policies that would normally prevent certain URL schemes or domain transitions. The flaw is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 6.5 (Medium severity) with a network attack vector, low complexity, no privilege requirement, but mandatory user interaction.

Business impact

This vulnerability enables attackers to manipulate user navigation flows, potentially redirecting users to phishing sites, credential harvesting pages, or malware distribution endpoints while the user believes they are interacting with trusted content. Organizations with iOS-heavy workforces or BYOD policies face increased phishing and social engineering risk. While not a direct data exfiltration vector, successful exploitation can serve as an entry point for downstream attacks. The requirement for active user interaction and synchronization with malicious network conditions limits mass exploitation but makes targeted campaigns against high-value users feasible.

Affected systems

Google Chrome on iOS prior to version 150.0.7871.47 is vulnerable. All iOS devices running affected Chrome versions are in scope. This includes iPhones and iPads. Organizations should inventory Chrome on iOS deployments and prioritize devices that browse sensitive corporate or financial applications. Users on older iOS versions with outdated Chrome installations face compounded risk if they cannot update the browser independently.

Exploitability

Exploitation requires both attacker-controlled network traffic and active user participation—specifically, convincing a user to perform defined UI gestures (such as tapping or scrolling in the Omnibox area) while the attacker injects malicious responses. This dual requirement reduces opportunistic exploitation but makes targeted, socially-engineered attacks viable. An attacker on the same network segment (e.g., compromised Wi-Fi) or with network interception capability (man-in-the-middle positioning) can execute this attack. The vulnerability is not known to be actively exploited in the wild (KEV status: not listed) at the time of publication, though this does not preclude future weaponization.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later immediately. Enable automatic app updates in iOS Settings > [app name] > App Store to ensure future Chrome releases are installed without manual intervention. For organizations with managed iOS devices (via MDM), deploy a device compliance policy requiring Chrome version 150.0.7871.47 minimum. Additionally, educate users to be cautious when performing gestures in the address bar and to verify that navigation events match their intent, especially on untrusted networks.

Patch guidance

Patch availability: Google Chrome version 150.0.7871.47 or later contains the fix. Users can verify their current version via Chrome menu > Settings > About Chrome, which will display the installed version and automatically check for updates. Organizations using Mobile Device Management (MDM) solutions such as Intune, Jamf, or Google Workspace can enforce minimum version policies to prevent users from remaining on vulnerable builds. Testing in pre-production environments is recommended before enforcing org-wide policies to ensure compatibility with internal web applications and workflows. Verify patch deployment against official Google Chrome release notes.

Detection guidance

Network-based detection is limited due to the requirement for malicious network traffic paired with user gestures; however, organizations can monitor for: (1) unusual navigation patterns or redirects originating from the Omnibox in browser logs, (2) users reporting unexpected redirects or being directed to suspicious domains after Chrome interactions, and (3) anomalous network traffic from iOS devices on Wi-Fi networks. Endpoint Detection & Response (EDR) solutions on managed iOS devices may flag suspicious gesture-triggered navigations if configured with behavioral analytics. User reports of unexpected browser behavior should be treated as potential exploitation signals. Consider deploying DNS filtering to block known phishing or malware distribution domains that attackers might use as redirection targets.

Why prioritize this

While the CVSS score is moderate (6.5), prioritization should account for iOS prevalence in modern organizations, the relative difficulty of detecting manipulation once exploited, and the phishing/social engineering amplification this vulnerability enables. Organizations with high-value user populations, sensitive financial or healthcare workflows, or strong BYOD adoption should treat this as higher priority. However, the requirement for active user manipulation and network interception capability lowers it below critical severity. Patch this within 30 days; within 2 weeks for organizations handling sensitive data or operating in targeted threat environments.

Risk score, explained

CVSS 3.1 score of 6.5 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), but mandatory user interaction (UI:R). The impact is high for integrity (I:H)—an attacker can redirect navigation—but no direct confidentiality or availability impact (C:N, A:N). The User Interaction requirement and the technical bar for synchronizing network interception with specific gestures prevent this from scoring higher, but the integrity impact and widespread iOS Chrome usage keep it solidly in the medium-to-high operational risk range for most organizations.

Frequently asked questions