CVE-2026-13910: Chrome Android WebXR Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-13910 is a policy enforcement failure in the WebXR API implementation within Google Chrome on Android. The vulnerability stems from insufficient validation of cross-origin boundaries (CWE-693: Improper Neutralization of Equivalent Elements in Access Control Lists), allowing a remote attacker to craft HTML content that circumvents the same-origin policy. This permits unauthorized access to data from different origins within the browser context. The vulnerability requires user interaction (clicking through to a malicious site) but does not require special privileges or complex exploitation conditions. Chromium's security team rated this as Medium severity.

Business impact

For organizations managing Android devices with Chrome browsers—whether corporate-owned or BYOD—this vulnerability presents a data exfiltration risk. Attackers could harvest credentials, session tokens, or sensitive information from enterprise web applications accessed on mobile Chrome. The practical impact depends on the sensitivity of data accessed via Chrome on managed devices and the likelihood of users encountering attack pages. Organizations with strict mobile device management policies may have reduced exposure, while those with open browsing policies face higher risk of credential compromise or account takeover.

Affected systems

The vulnerability affects Google Chrome on Android devices running versions prior to 150.0.7871.47. Desktop Chrome and other browsers are not affected. Android devices using alternate browsers (Firefox, Edge, Samsung Internet) are unaffected by this specific vulnerability. The WebXR API is primarily used for augmented and virtual reality experiences, but the policy enforcement failure affects the broader cross-origin protection mechanism.

Exploitability

This vulnerability has a low-to-moderate barrier to exploitation. An attacker must convince a user to visit a crafted webpage, making phishing campaigns or compromised advertisement networks potential delivery vectors. Once a user arrives at the malicious page, exploitation is automatic and requires no additional user action beyond the initial visit. No authentication or special system configuration is needed on the attacker's side. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation has not been widely observed, though this does not guarantee future exploit availability.

Remediation

Organizations should prioritize updating Chrome on Android devices to version 150.0.7871.47 or later. Device administrators can enforce this update through mobile device management (MDM) platforms such as Google Workspace, Microsoft Intune, or third-party MDM solutions that support Android devices. End users without MDM enrollment should manually update Chrome via the Google Play Store. No workarounds are available; patching is the only mitigation.

Patch guidance

Verify that all Android devices have Chrome updated to 150.0.7871.47 or a more recent version. Check the Chrome version by opening Chrome, navigating to Settings > About Chrome, and confirming the version number. For enterprise environments, push the update via your MDM solution's application management policies to ensure compliance. Google typically rolls out patches over several days; organizations may wish to manually expedite the update on critical devices.

Detection guidance

Detection of exploitation is challenging at the endpoint level because the attack occurs entirely within the browser's JavaScript context. Network monitoring tools cannot easily identify malicious WebXR policy bypasses. Focus on behavioral monitoring: watch for unusual data exfiltration patterns from Chrome processes, particularly to unexpected external domains, or anomalous access logs from web applications accessed via mobile devices. Endpoint detection and response (EDR) tools may flag suspicious process behavior if the attack attempts to exfiltrate large volumes of data, but signature-based detection is unlikely to be effective. Assume compromise if users report unexplained account access, credential theft, or fraudulent transactions following visits to untrusted websites.

Why prioritize this

Although rated Medium severity with a CVSS score of 6.5, this vulnerability warrants prompt patching because it enables silent cross-origin data theft without user awareness, affects mobile devices often used for sensitive business tasks, and requires only user interaction (not authentication bypass). The lack of current exploitation does not reduce urgency; the barrier to weaponization is low. Organizations handling healthcare data, financial services, or identity information on mobile Chrome should prioritize this patch within one to two weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R). The impact is confined to confidentiality (C:H) with no integrity or availability loss (I:N/A:N). The unchanged scope (S:U) indicates the vulnerability does not jump privilege boundaries. This Medium rating accurately captures the real-world risk: significant data theft potential tempered by the need for user interaction and the absence of code execution or system compromise.

Frequently asked questions