CVE-2026-13944: Chrome macOS Cross-Origin Data Leak (CVSS 3.1)

Technical summary

CVE-2026-13944 is a cross-origin data leak vulnerability in Chrome's DataTransfer implementation on macOS. The flaw stems from inappropriate handling of data transfer operations, allowing an attacker to craft HTML pages that, when combined with specific user UI gestures, can exfiltrate data from one origin to another. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery/CSRF), indicating a failure to properly enforce origin isolation during data operations. The Chromium security team assigned this a Medium severity rating, though the CVSS 3.1 score of 3.1 reflects the high barrier to exploitation: the attacker must achieve user interaction on a crafted page, and the impact is limited to confidentiality of origin-specific data.

Business impact

The business risk from this vulnerability is minimal in most environments. Exploitation requires social engineering to convince users to interact with a malicious page in specific ways, and the data exposed is limited to what exists within the browser's data transfer context. For organizations with users accessing sensitive web applications, there is a theoretical risk that attackers could craft pages targeting those applications; however, the low CVSS score and high interaction bar suggest this is not an active threat vector in most threat models. This vulnerability does not enable remote code execution, privilege escalation, or system-wide compromise.

Affected systems

This vulnerability affects Google Chrome on macOS systems running versions prior to 150.0.7871.47. Windows, Linux, Android, and iOS versions of Chrome are not mentioned as affected. macOS users with Chrome installed should verify their version and apply updates. Organizations managing Chrome deployments via mobile device management (MDM) or enterprise policies should verify update status across managed Mac devices.

Exploitability

Exploitation requires multiple conditions: the attacker must host a crafted HTML page, convince a user to visit it, and induce specific UI gestures from that user. This multi-step social engineering requirement significantly limits practical exploitability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of active exploitation in the wild at the time of disclosure. The attack surface is further constrained by the fact that users must actively engage with browser UI elements in ways they do not typically perform.

Remediation

Apply Chrome version 150.0.7871.47 or later on all affected macOS systems. Users can manually update Chrome via Settings > About Google Chrome, which will prompt download and installation with a browser restart. Organizations should push this update through standard patch management channels and verify completion across their managed Mac estate. No workarounds are available; patching is the only mitigation.

Patch guidance

Verify that Chrome has been updated to version 150.0.7871.47 or later. On macOS, users can confirm the version by clicking the Chrome menu, selecting 'About Google Chrome', and verifying the build number. For enterprise deployments, consult Google's official Chrome release notes and security advisories to confirm patch deployment. No interim versions or partial patches address this specific vulnerability; full update to 150.0.7871.47 is required.

Detection guidance

Detection of exploitation attempts would be challenging without endpoint telemetry, as the vulnerability manifests as suspicious data transfer behavior within the browser process. Behavioral indicators include users receiving phishing or social engineering messages directing them to interact with specific webpage elements in unusual ways. Network detection is unlikely to flag this activity, as the malicious traffic would appear as normal HTTPS communication to legitimate sites. Endpoint detection and response (EDR) solutions may observe unusual data flow patterns from Chrome processes, but this should be correlated with user reports or browser extension logs. For most organizations, proactive patching is more effective than detection.

Why prioritize this

This vulnerability should be prioritized based on standard patch cadence rather than emergency response. The CVSS score of 3.1, combined with the lack of KEV status and the high barrier to exploitation, makes this a routine maintenance update rather than a critical patch. However, organizations should still aim for timely deployment within 2-4 weeks, as the attack is theoretically possible and affects a widely-used browser. Prioritize systems where users are exposed to untrusted content or high-risk browsing scenarios.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects several mitigating factors: Network-based attack vector (AV:N) is offset by High attack complexity (AC:H), requiring specific UI gestures and user interaction (UI:R). The scope is Unchanged (S:U), meaning the vulnerability cannot be leveraged to affect systems or data outside Chrome's sandbox. Confidentiality impact is Low (C:L), as only data within the transfer context may leak, not the entire system or all user data. Integrity and Availability are not impacted (I:N/A:N). The combination yields a score that reflects real but limited risk—notable enough to patch, but not urgent enough to disrupt operations.

Frequently asked questions