CVE-2026-13929: Chrome Android DevTools Navigation Policy Bypass

Technical summary

CVE-2026-13929 stems from insufficient policy enforcement in Chrome's DevTools implementation on Android. The vulnerability allows circumvention of navigation policy controls through a malformed or specially crafted file. The attack surface is local (AV:L), requires no special privileges (PR:N), but does require user interaction (UI:R), meaning the victim must open or interact with the attacker-supplied file. The Chromium security team classified this as Medium severity. The underlying weakness maps to CWE-20 (Improper Input Validation), reflecting inadequate sanitization or enforcement of navigation policy rules when processing malicious input.

Business impact

For organizations managing Android devices running Chrome, this vulnerability poses a low-to-moderate risk. An attacker with local access could redirect users to unintended sites or bypass intended navigation guardrails—potentially for phishing, credential harvesting, or traffic redirection attacks. However, the requirement for local access and user interaction significantly limits opportunistic exploitation. Organizations relying on Chrome as a managed browser or deploying strict browsing policies should prioritize patching to maintain policy integrity and user trust in navigation controls.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on Android are vulnerable. Desktop Chrome is not affected. The vulnerability is specific to Android's DevTools implementation, so mobile device inventory and Chrome version audit are essential to determine exposure.

Exploitability

Exploitation requires local device access and user interaction—the attacker must trick a user into opening a malicious file. No remote exploitation is possible, and no special system privileges are needed. While not trivial, the barrier to exploitation is relatively low in environments where users frequently download or transfer files locally. The lack of KEV listing indicates no active in-the-wild exploitation has been observed or reported to CISA as of the publication date.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users should check Settings > About Chrome to verify their current version and enable automatic updates if not already active. Organizations managing devices via MDM should push the update through their device management platform to ensure compliance.

Patch guidance

Google Chrome on Android auto-updates by default if configured in the Play Store settings. Verify the update by navigating to Chrome menu > Settings > About Chrome; the browser will check for updates automatically. For enterprise deployments using Android Enterprise or Samsung Knox, push the update via MDM policies to ensure all managed devices receive version 150.0.7871.47 or later. Test the update on a representative device before broad rollout to confirm no compatibility issues with your organization's apps or workflows.

Detection guidance

Monitor Chrome version inventory across your Android fleet using MDM reporting or endpoint detection tools. Query for any devices running Chrome versions below 150.0.7871.47. Additionally, watch for suspicious user behavior such as unexpected navigation to unfamiliar domains or file download and opening patterns that could indicate exploitation attempts. Note that exploitation leaves minimal forensic traces; focus on version compliance as the primary control.

Why prioritize this

While the CVSS score of 5.5 places this in the medium range and the local-access requirement limits exposure, the integrity impact on navigation policy enforcement is significant for organizations with strict browsing policies or compliance requirements. The lack of in-the-wild exploitation (no KEV listing) slightly reduces urgency, but the simplicity of the exploit vector—user interaction with a malicious file—warrants prompt patching within a standard maintenance window. Prioritize based on your organization's reliance on Chrome for managed browsing and policy enforcement.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector (lower impact than remote), no privilege elevation required, user interaction needed (user must open the file), and integrity impact (navigation policy bypass) with no confidentiality or availability impact. The score appropriately captures the moderate risk: the flaw is real and exploitable, but only under constrained conditions. For organizations heavily dependent on Chrome navigation controls, the business risk may warrant treatment as High priority despite the medium CVSS score.

Frequently asked questions