CVE-2026-13924: Chrome Android WebView Same-Origin Bypass (CVSS 6.5)

Technical summary

CVE-2026-13924 involves insufficient input validation in WebView (CWE-20) on Android Chrome. The vulnerability exists in the renderer process; an attacker with renderer-level code execution can craft HTML content that exploits a validation gap to circumvent the same-origin policy enforcement. The CVSS 3.1 vector (6.5 MEDIUM, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects network-based attack, low complexity, no privileges required, and user interaction needed, with high integrity impact but no confidentiality or availability impact. The flaw does not require attacker privileges beforehand but does require a compromised renderer process.

Business impact

Successful exploitation could allow an attacker to read, modify, or exfiltrate sensitive data from one origin when accessed by the same browser instance, such as cached credentials, session tokens, or user-generated content on different websites. For enterprises, the risk is heightened if users have multiple sensitive tabs open simultaneously. The integrity-focused impact (high I rating, no confidentiality/availability) means data tampering and cross-site request forgery risks are the primary concern, not service disruption.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. The WebView component is used by Chrome and other Android applications that rely on Chromium's rendering engine. Any application using vulnerable Chrome versions is exposed, though exploitation requires the renderer process itself to be compromised first.

Exploitability

The vulnerability requires two conditions: (1) the attacker must have already compromised the Chrome renderer process (often via another vulnerability or malicious JavaScript), and (2) the user must visit a page with the attacker's crafted HTML. The low complexity and absence of special privileges make the second step relatively easy, but the prerequisite renderer compromise is a significant constraint. The requirement for user interaction means phishing or social engineering is necessary. Current public exploit code is not known; the issue is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. No workarounds exist for unpatched versions. Users should prioritize this update, especially in environments handling sensitive cross-origin data. Administrators should enforce auto-updates where possible.

Patch guidance

Ensure Chrome for Android is updated to 150.0.7871.47 or later. Verify the update through Chrome's Settings > About Chrome, which will show the current version and check for updates automatically. For managed Android devices (via Mobile Device Management), administrators should deploy the update via their MDM solution and confirm rollout within 7–14 days. Test with a small pilot group first if automated updates are restricted.

Detection guidance

Monitor for unusual iframe or cross-origin iframe loads within a single browser session, particularly in security logs from devices or network proxies. Intrusion Detection Systems (IDS) may flag suspicious crafted HTML patterns, though detection is difficult without visibility into renderer-process behavior. Endpoint Detection and Response (EDR) tools should monitor for signs of renderer-process compromise (e.g., unexpected child processes, memory injection, abnormal system calls). Check Chrome version compliance using mobile device inventory and version-reporting tools.

Why prioritize this

Assign this a moderate priority (not critical, but time-bound). Although the CVSS is 6.5 Medium and the issue is not yet in CISA's KEV catalog, the potential for data tampering across sensitive websites, combined with the low barrier to user interaction, makes it a clear target for socially engineered attacks. Prioritize remediation for users who handle financial data, healthcare information, or multi-account access patterns. Organizations with app-based workflows on Android should verify that in-app WebViews are also updated.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the high integrity impact (I:H) balanced against the requirement for renderer-process compromise and user interaction. The score does not account for real-world context, such as widespread rendering-engine compromises via other CVEs or the prevalence of multi-tab workflows with sensitive data. In a threat landscape where renderer exploits are chained with this flaw, effective severity could be higher.

Frequently asked questions