CVE-2026-13943: Chrome Android Memory Disclosure via CSS – Security Analysis & Patch Guidance

Technical summary

CVE-2026-13943 is an uninitialized use vulnerability (CWE-457) in Chrome's CSS processing on Android. When the CSS engine processes crafted stylesheets within an HTML page, it fails to initialize certain memory regions before use, creating an information disclosure vector. An attacker-controlled webpage can trigger this condition to read adjacent process memory. The vulnerability requires user interaction (visiting a malicious site) but no special privileges; the CVSS 3.1 vector reflects network accessibility, low attack complexity, and high confidentiality impact with no integrity or availability compromise.

Business impact

Information disclosure on Android devices poses risks to enterprise mobility programs and personal users alike. Leaked credentials, session tokens, or cached sensitive data could enable account takeovers or lateral movement in corporate environments where Chrome is the primary mobile browser. Organizations with BYOD policies or mobile-centric workflows should treat this as a priority remediation item to prevent exfiltration of business-critical or personally identifiable information from employee devices.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47. Users running Chrome 149 or earlier on any Android device (phones and tablets) are vulnerable. Other Chromium-based browsers on Android may share similar code paths; verify vendor advisories for Edge, Samsung Internet, Opera, and other derivatives if your organization uses them.

Exploitability

Exploitation requires user interaction: a victim must visit or be redirected to an attacker's HTML page. No authentication or elevated privileges are needed. The attack surface is broad—any site an Android user visits could host the malicious payload. However, this is not a wormable or self-propagating vulnerability; each attack requires active user navigation, which provides a modest friction barrier but not a strong defense.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. In settings, enable automatic app updates if not already enabled, or manually check for updates via the Google Play Store. Organizations should communicate the availability of this patch to users and consider deploying Mobile Device Management (MDM) policies to enforce minimum Chrome versions on managed Android devices.

Patch guidance

Chrome on Android typically receives updates through the Google Play Store. Users can manually update via Settings > Apps > Google Play Store > Search for Chrome > Update, or enable automatic updates for the Chrome app in Play Store settings. Enterprise administrators using MDM solutions (such as Google Workspace Device Management or third-party EMM platforms) should set a minimum version requirement for Chrome to 150.0.7871.47 or newer. No interim workarounds are documented; patching is the primary mitigation.

Detection guidance

Monitor for Chrome version compliance on Android devices via MDM reporting. On the endpoint, users can verify their Chrome version by navigating to Chrome settings > About Chrome, which will display the current version and update status. Network-based detection of exploitation is difficult due to the in-memory nature of the leak; focus on patch adoption metrics and encourage rapid rollout. If you suspect active exploitation, monitor for unusual data exfiltration or credential misuse correlated with unpatched Chrome usage.

Why prioritize this

Although the CVSS score is moderate (6.5) and the vulnerability is not currently on CISA's KEV list, the attack surface is significant: Chrome is ubiquitous on Android, and any webpage visit can trigger exploitation. Information disclosure of memory contents poses a real risk to confidentiality of cached credentials and session data. Prioritize patching over lower-profile vulnerabilities, especially in environments where employee or customer data is processed on Android devices. The user-interaction requirement is a limiting factor but not a blocker for active adversaries who can lure users to malicious sites.

Risk score, explained

The CVSS 6.5 MEDIUM rating reflects high confidentiality impact (memory disclosure), low attack complexity (crafted HTML), network accessibility, and the requirement for user interaction. The lack of integrity or availability impact prevents a CRITICAL or HIGH score, but the broad attack surface and real-world leakage of sensitive process memory warrant swift remediation. Organizations handling regulated data should treat this as HIGH priority internally, despite the moderate CVSS badge.

Frequently asked questions