CVE-2026-13917: Chrome for iOS Navigation Bypass Vulnerability (CVSS 6.5)

Technical summary

CVE-2026-13917 is a CWE-20 (Improper Input Validation) vulnerability in Chrome for iOS affecting versions prior to 150.0.7871.47. The flaw stems from insufficient validation of untrusted input in the iOS-specific implementation of Chrome's navigation handling. A remote attacker can craft an HTML page that, when combined with specific user UI gestures, bypasses navigation restrictions that would normally prevent unwanted redirects or state changes. The vulnerability is classified as Medium severity by Chromium and has a CVSS 3.1 score of 6.5, reflecting network accessibility with user interaction required but no confidentiality impact.

Business impact

Navigation bypass vulnerabilities can erode user trust in browser security mechanisms and expose users to phishing, credential harvesting, or malware distribution sites disguised as legitimate destinations. For organizations managing iOS devices and user access policies, this could undermine controls that rely on Chrome's navigation enforcement. The threat is contextual—high-risk environments with users visiting untrusted content or those targeted by social engineering campaigns face greater exposure.

Affected systems

Apple iOS devices running Google Chrome versions prior to 150.0.7871.47 are affected. This includes all iOS release lines where Chrome is installed. macOS and Android versions are not referenced in this vulnerability, though administrators should verify Chrome version numbers across all deployment platforms.

Exploitability

Exploitation requires convincing a user to visit a malicious website and perform specific UI interactions, making this attack dependent on social engineering or drive-by tactics. No exploitation attempts are documented in public databases. The CVSS vector (AC:L, PR:N, UI:R) indicates low attack complexity but mandatory user interaction, classifying this as moderately exploitable rather than highly automated.

Remediation

Update Google Chrome for iOS to version 150.0.7871.47 or later. Apple iOS device management administrators should deploy this update through MDM solutions or notify users to update via the App Store. Verify the Chrome version in installed app inventories before and after deployment to confirm remediation.

Patch guidance

Google has released Chrome 150.0.7871.47 and later versions containing the fix. iOS users should update through the App Store; managed device environments should push the update via MDM configuration. Verify that auto-update is enabled in Chrome settings, or enforce mandatory updates through organizational policy. Test the patched version on a small cohort of devices before full rollout to confirm functionality.

Detection guidance

Monitor Chrome version numbers in endpoint telemetry and mobile device management systems for any instances still running pre-150.0.7871.47 versions. Web proxy or security gateway logs may show anomalous navigation patterns if users are being redirected unexpectedly, though attribution to this specific flaw would require additional context. Consider tracking failed navigation enforcement events in Chrome telemetry if available through enterprise reporting.

Why prioritize this

Medium CVSS score combined with user interaction requirements positions this as important but not critical. Priority should be elevated in high-risk user populations (executives, sensitive data handlers, users in targeted geographies) and in environments where iOS is the primary or exclusive mobile platform. Patch deployment should follow standard change control but without emergency expediting unless corroborated evidence of active exploitation emerges.

Risk score, explained

The 6.5 CVSS 3.1 score reflects a network-accessible vulnerability with low attack complexity but mandatory user interaction and no direct confidentiality compromise. Integrity is impacted because attackers can manipulate navigation and potentially direct users to malicious or fraudulent destinations. The lack of confidentiality or availability impact, combined with the social engineering dependency, prevents a higher score. Organizations using defense-in-depth strategies (phishing filters, DNS filtering, endpoint detection) can further mitigate residual risk.

Frequently asked questions