CVE-2026-13932: Chrome Android Data Leakage via Renderer Compromise

Technical summary

CVE-2026-13932 stems from an inappropriate implementation of the sharing mechanism in Chrome's renderer process on Android. The vulnerability exists in how Chrome handles cross-origin data access when the renderer process has been compromised. An attacker with renderer process control can craft HTML that leaks data normally isolated by the same-origin policy. The flaw is classified under CWE-284 (Improper Access Control), indicating a breakdown in the mechanism that should enforce origin boundaries. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects network attack surface, low attack complexity, user interaction requirement, and high confidentiality impact without integrity or availability concerns.

Business impact

Organizations managing Android devices with Chrome users face potential data exposure. If an employee's Chrome renderer is compromised—whether through a separate vulnerability, malware, or supply-chain attack—an attacker gains a low-friction path to exfiltrate authentication tokens, session cookies, or sensitive information from multiple sites the user visits simultaneously. This is particularly concerning in BYOD environments or where employees access cloud applications and SaaS platforms. The attack does not disrupt service or modify data, but confidentiality breach can lead to account takeovers and lateral movement within connected systems.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are affected. The vulnerability is Android-specific; Chrome on Windows, macOS, Linux, iOS, and other platforms is not mentioned in this advisory. Organizations should inventory Chrome installations on Android devices, including enterprise-managed devices, personal devices with work profiles, and any shared or kiosk devices.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised, and (2) the user must visit a malicious or attacker-controlled webpage. The vulnerability is not a zero-click or self-propagating flaw. An attacker cannot exploit it remotely without first achieving renderer compromise through a separate attack vector (another Chrome vulnerability, native code exploit, or malware). Once those conditions are met, the attack is straightforward. Because renderer compromise is a prerequisite, this is a post-exploitation privilege-escalation vector rather than a primary entry point. It is not tracked in the CISA KEV catalog, indicating it is not currently known to be exploited in the wild.

Remediation

Update Chrome on Android to version 150.0.7871.47 or later. Google typically pushes updates automatically, but users should manually check for available updates in the Google Play Store or through Chrome's Settings > About Chrome menu. Organizations with managed Android devices should deploy this update via their MDM (Mobile Device Management) solution. Verify the update is applied across all devices in scope. No workarounds are available for unpatched versions other than restricting access to untrusted websites or disabling Chrome features, neither of which is practical.

Patch guidance

Verify against the vendor advisory that Chrome version 150.0.7871.47 on Android is the fix version. Deploy through your standard Chrome update mechanism—automatic updates via Google Play, or manual installation. If using an MDM platform (Google Workspace, Microsoft Intune, etc.), configure the policy to enforce the minimum version or enable auto-update. Test in a non-production environment first to ensure no compatibility issues with your organization's web applications. Monitor deployment success metrics to confirm coverage across your Android device fleet.

Detection guidance

Monitor Chrome version numbers on Android devices using your MDM solution, mobile security platform, or endpoint detection tools. Flag any device running Chrome below version 150.0.7871.47. In a post-compromise investigation, if you suspect renderer process compromise, look for unusual process-level activity, unexpected network connections from the Chrome process, or memory anomalies. Browser logs and cache forensics may reveal traces of malicious HTML pages, though the renderer process compromise itself is the critical indicator. Consider enabling enhanced logging on managed devices if your MDM supports it.

Why prioritize this

Although this vulnerability carries a CVSS score of 6.5 (Medium) and is not yet in active exploitation, it merits prompt but not emergency-level attention. The vulnerability requires pre-existing renderer compromise, which limits its standalone exploitability. However, it significantly amplifies the impact of any other Chrome vulnerability that grants renderer access. Organizations should patch within their standard maintenance windows—typically within 30 days—giving priority to high-value Android devices (those handling sensitive data, used by privileged users) and BYOD environments where control is limited. The absence of KEV status and active exploitation reduces urgency, but the confidentiality impact justifies avoiding prolonged deferral.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network-accessible attack vector—standard web browsing; (2) Low attack complexity—no special conditions beyond renderer compromise; (3) User interaction required—victim must visit a malicious page; (4) Unchanged scope—attack stays within the Chrome process boundary; (5) High confidentiality impact—full access to cross-origin data; (6) No integrity or availability impact—data is read-only. The score would be higher (7.0+) if it required no user interaction or enabled code execution beyond the renderer; it would be lower if it required authentication or special user privileges beyond opening a browser. The Medium severity aligns with the prerequisite of renderer compromise, which is a significant but not insurmountable constraint.

Frequently asked questions