CVE-2026-13936: Chrome Android Password Memory Disclosure Vulnerability

Technical summary

CVE-2026-13936 is a medium-severity information disclosure vulnerability in the password handling implementation of Google Chrome for Android. The issue stems from improper access controls (CWE-284) in the password subsystem, permitting remote code execution context to read sensitive data from process memory. The attack surface is limited to scenarios where a user navigates to an attacker-controlled HTML page; the vulnerability cannot be exploited through passive network access or without user interaction. Chromium has assigned a Medium security severity rating and patched the flaw in version 150.0.7871.47 and later.

Business impact

For organizations with Android-using employees or BYOD policies, this vulnerability creates a credential theft risk. Attackers could harvest saved passwords or authentication tokens cached in Chrome memory, potentially compromising corporate accounts and sensitive systems if users' personal devices store work-related credentials. The impact is primarily confidentiality; no system availability or integrity concerns exist. Organizations managing Android device fleets should prioritize awareness and patch deployment to minimize exposure.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. The flaw does not affect Chrome on desktop platforms (Windows, macOS, Linux) or other Android browsers. Google Android itself is listed as a vendor product in relation to Chrome's integration; however, the vulnerability is specific to Chrome's password handling code. Users should verify the exact version on their devices, as patch adoption rates vary across Android devices due to manufacturer update delays.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing or tricking a user into visiting it via a link, email, advertisement, or compromised website. No zero-click or drive-by download mechanism exists. The attacker gains no direct execution capability but can extract sensitive data resident in Chrome's process memory—typically cached passwords, OAuth tokens, or similar credentials. The barrier to entry is low for an attacker with basic web development skills, but the social engineering component makes mass exploitation less efficient than network-propagated vulnerabilities.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users can check their version in Chrome settings (usually chrome://version or Settings > About Chrome). Organization administrators using Mobile Device Management (MDM) solutions should push Chrome updates via their management console. For maximum protection, encourage users to avoid clicking suspicious links and to keep their Android devices and all apps automatically updated.

Patch guidance

Google has released version 150.0.7871.47 of Chrome for Android as the patched release. Most users will receive the update automatically; however, on some Android devices, updates may be delayed by the device manufacturer or carrier. Users can manually check for updates in Google Play Store by searching for Chrome, viewing the app page, and tapping "Update" if available. For enterprise deployments, verify patch status through your MDM reporting dashboards and ensure automatic app updates are enabled in managed Google Play or equivalent management platform.

Detection guidance

Detection is challenging on the client side without robust endpoint detection and response (EDR) capability on mobile devices. Organization-level signals to monitor include: (1) anomalous credential usage from Android devices (impossible travel, unexpected geographic login), (2) sudden spikes in failed authentication attempts using credentials known to be on at-risk devices, and (3) alerts from identity providers flagging suspicious Android user-agent strings or device identifiers. Network-side detection of exploitation attempts is not practical since the attack is HTTP-based and resembles normal user browsing.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability merits near-term remediation because credential theft directly undermines authentication security and can cascade into lateral movement within corporate networks. Android deployment fragmentation means patches may not reach all devices quickly, extending the exposure window. Organizations with BYOD or Android-heavy workforces should treat this as elevated priority. The lack of KEV status and active exploitation in the wild reduces urgency for emergency response, but should not delay standard patching schedules.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects an unauthenticated, network-accessible attack requiring user interaction, with high confidentiality impact but no integrity or availability impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) correctly penalizes the user interaction requirement while rewarding the attacker's low barrier to exploitation (no special access control bypass needed). In risk prioritization, organizations should layer business context on top: credential compromise may warrant elevation in practice if affected users have high-privilege accounts or access to critical systems.

Frequently asked questions