CVE-2026-13921: Chrome DeviceBoundSessionCredentials Same-Origin Policy Bypass (CVSS 6.5)

Technical summary

The vulnerability stems from insufficient input validation in the DeviceBoundSessionCredentials mechanism within Chrome's codebase (CWE-20: Improper Input Validation). DeviceBoundSessionCredentials is a feature designed to bind session tokens to a specific device to prevent token theft. However, inadequate sanitization or validation of untrusted input allows a remote attacker to craft HTML that circumvents the same-origin policy (SOP), potentially enabling unauthorized access to or manipulation of cross-origin resources. The attack surface is the network (AV:N), requires low attack complexity (AC:L), needs no special privileges (PR:N), and requires user interaction (UI:R) to trigger the malicious page visit.

Business impact

A successful exploit could allow attackers to access sensitive data from other websites a user is logged into, forge requests on the user's behalf across different origins, or perform actions within other web applications without authorization. This could lead to account compromise, data exfiltration, or unauthorized transactions, particularly targeting users of high-value services (banking, email, SaaS platforms). The impact is amplified if victims are employees with access to internal or enterprise systems.

Affected systems

All Google Chrome installations prior to version 150.0.7871.47 are affected. This includes Chrome on Windows, macOS, Linux, and Chrome-based browsers that embed the Chromium engine. Users running Chrome 150.0.7871.47 or later are not vulnerable. Verify your installed version via chrome://version/.

Exploitability

The vulnerability is exploitable by any unauthenticated remote attacker who can convince a user to visit a crafted HTML page. No special network position, code execution, or authentication is required on the attacker's side. Exploitation likelihood is moderate: it depends on user interaction (clicking a link or visiting a site), but such phishing or drive-by scenarios are common attack vectors. The vulnerability was not flagged for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active exploitation in the wild at the time of publication.

Remediation

Update Chrome to version 150.0.7871.47 or later immediately. Chrome typically updates automatically, but users should verify their version and manually force an update if needed. Organizations managing Chrome deployments should use Chrome's managed update mechanisms to ensure fleet-wide patching. No workarounds are available; patching is the only mitigation.

Patch guidance

Navigate to chrome://settings/help in any Chrome window. Chrome will automatically check for updates and display the installed version. If the version is below 150.0.7871.47, Chrome will download and install the latest build (restart may be required). For enterprise deployments, administrators should push this update via Google Admin Console or third-party patch management tools. Verify successful patching by confirming the version number matches or exceeds 150.0.7871.47.

Detection guidance

Network and endpoint detection of this vulnerability is limited because exploitation leaves minimal forensic traces—the attack relies on HTML crafting and same-origin policy bypass at the browser level. Security teams should focus on behavioral monitoring: detect users visiting suspicious or unexpected domains that might host exploit payloads, monitor for anomalous cross-origin requests from users' browsers, and scan for phishing campaigns that distribute links to crafted HTML pages. Browser logs (chrome://net-internals) may record unusual redirect or request patterns if analyzed post-incident. Timely patching remains the primary defense.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 6.5 (Medium) reflects moderate severity: impact is limited to integrity (high impact to authorization/trust boundaries) with no direct confidentiality or availability harm. However, same-origin policy bypass is a fundamental browser security violation that could enable account takeover or fraud if chained with social engineering. Priority should be elevated in environments where users interact with sensitive web applications (financial services, healthcare, government). The absence of KEV status and active exploitation lowers urgency compared to critical or zero-day scenarios, but this should not delay patching beyond 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-reachable (AV:N), low-complexity (AC:L), unprivileged (PR:N) attack requiring user interaction (UI:R). Integrity is marked as High (I:H) because same-origin policy bypass undermines trust and authorization mechanisms, allowing attackers to forge or manipulate requests as if from trusted origins. Confidentiality and availability are unaffected (C:N, A:N), and the scope is unchanged (S:U), meaning the impact is limited to the intended resource. The Medium severity designation is appropriate: the attack is serious but not as critical as remote code execution or data exfiltration without user action.

Frequently asked questions