CVE-2026-13913: Chrome iOS Autofill Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-13913 stems from insufficient policy enforcement in the autofill mechanism of Google Chrome on iOS. The vulnerability allows cross-origin data leakage through a crafted HTML page when a user performs specific UI gestures. The flaw is classified under CWE-346 (Origin Validation Error), indicating a failure to properly validate or enforce same-origin policy boundaries. The attack vector is network-based with low complexity; no special privileges are required, but user interaction is mandatory. The confidentiality impact is high while integrity and availability remain unaffected.

Business impact

This vulnerability poses a moderate but meaningful risk to users of Chrome on iOS. Users who visit malicious websites could have sensitive autofill data—such as saved credentials, addresses, or payment information—exposed to those sites. For organizations, this could lead to credential compromise if employees use personal iOS devices for work or access corporate systems through mobile browsers. The requirement for specific user gestures limits mass exploitation but does not eliminate the threat, particularly in phishing or social engineering scenarios.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are affected. This includes all earlier release branches on Apple iPhone OS. Users on other platforms or later Chrome versions are not impacted by this specific vulnerability. Organizations should focus patch efforts on iOS-based deployments and user bases reliant on mobile Chrome.

Exploitability

Exploitation requires a remote attacker to serve a crafted HTML page and convince a user to interact with it in a specific manner—for example, triggering autofill suggestions or focusing on form fields. The low complexity and lack of privilege requirements make this practical for attackers, but the explicit user interaction requirement (demonstrated by the UI:R flag in the CVSS vector) means mass exploitation through passive delivery is not possible. Targeted phishing or social engineering attacks would be the most realistic attack scenario.

Remediation

Users and organizations should update Chrome on iOS to version 150.0.7871.47 or later as soon as possible. Apple's App Store typically distributes updates automatically, but users can manually check for and install updates through the App Store settings. Verify that automatic updates are enabled on managed iOS devices. No workarounds are available for earlier versions, so patching is the only effective mitigation.

Patch guidance

Update Google Chrome on iOS to version 150.0.7871.47 or later. Check the official Chrome release notes and Google Security Advisory pages to confirm patch availability in your region. For enterprise deployments using Mobile Device Management (MDM), configure policies to enforce automatic app updates or deploy the patched version through your MDM console. Verify successful deployment by checking the Chrome version in each device's About Chrome menu (Settings > About Chrome). Consider prioritizing devices used by high-risk users such as those handling sensitive data or interacting with external partners.

Detection guidance

Detection of exploitation attempts is difficult because the attack relies on user interaction with a crafted webpage rather than network signatures. Monitor for suspicious autofill behavior reports from users, such as unexpected data appearing in form fields from untrusted sites. Web application firewall (WAF) rules may not effectively detect this attack. Instead, focus detection efforts on identifying the vulnerability's presence: scan endpoints to confirm Chrome version numbers, and use mobile device inventory tools to identify devices still running Chrome versions prior to 150.0.7871.47. Post-patch, detection would primarily involve hunting for historical cross-origin data exposure through user reports or security logs.

Why prioritize this

This vulnerability merits medium priority patching due to its CVSS score of 6.5 and the high confidentiality impact combined with low barrier to exploitation. While the user interaction requirement prevents automated large-scale attacks, targeted phishing campaigns could easily leverage this flaw to steal credentials or sensitive personal data. The widespread use of Chrome on iOS and the sensitive nature of autofilled data (credentials, payment info) amplify business risk. It is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but proactive patching is advisable given the straightforward exploitation mechanism.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements. The score is driven primarily by the high confidentiality impact (users' autofill data can be exposed) and tempered by the requirement for user interaction and the lack of integrity or availability impact. The score appropriately captures a moderate-risk vulnerability that demands attention but is not critical to emergency response protocols.

Frequently asked questions