CVE-2026-13946: Chrome iOS Cross-Origin Data Leak Vulnerability (Medium)

Technical summary

CVE-2026-13946 is a cross-origin information disclosure vulnerability in Chrome's ScriptInjections implementation on iOS. The flaw permits a network attacker to exfiltrate data across origin boundaries through a malicious HTML page when a user is socially engineered into visiting it. The underlying weakness is classified as CWE-352 (Cross-Site Request Forgery or CSRF-like behavior), though the actual vector involves script injection rather than traditional CSRF. The vulnerability was patched in Chrome 150.0.7871.47 and affects all prior versions on iOS.

Business impact

Organizations whose employees use Chrome on iOS face a data leakage risk if targeted by attackers. Sensitive information—such as authentication tokens, session data, or personal details exposed in web applications—could be stolen without detection. The impact is limited by the CVSS C:L (confidentiality low) rating and the requirement for user interaction, but in environments handling regulated data or competitive intelligence, even partial leakage poses compliance and business continuity concerns. Customer-facing applications should assume some iOS Chrome users may be compromised.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on iOS are affected. This includes iPhone and iPad users running older Chrome builds. The vulnerability does not affect Chrome on Android, macOS, Windows, or Linux, nor does it affect Safari or other iOS browsers. Organizations should focus mitigation on iOS endpoints accessing sensitive web services.

Exploitability

Exploitability is straightforward from a technical standpoint but requires user action. An attacker must craft a malicious HTML page and socially engineer a user (via phishing, watering hole attacks, or advertising) to visit it while logged into a sensitive service. Once loaded, the page can leak cross-origin data without additional user consent. No authentication is required, and the network barrier to entry is low (CVSS AV:N). The practical exploitation rate is likely moderate because it depends on successful social engineering and the victim's browsing habits.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users can enable automatic updates in the App Store settings to receive patches without manual intervention. For organizations without device management, communicating the update to users and enforcing minimum Chrome version policies (if using Mobile Device Management) is advisable. Until patched, users should avoid clicking links from untrusted sources and consider using Safari for accessing highly sensitive applications.

Patch guidance

Verify and deploy Chrome version 150.0.7871.47 or later on all managed iOS devices. If using Mobile Device Management (MDM) solutions such as Intune, Jamf, or MobileIron, configure policies to enforce minimum version requirements and automatic updates. For BYOD environments, provide clear guidance to employees and monitor adoption rates. No configuration workarounds exist; patching is the sole remediation.

Detection guidance

Detection is challenging without endpoint visibility. Look for indicators such as users accessing sensitive web applications from older Chrome builds on iOS (via user-agent analysis in web server logs, though spoofing is possible). Monitor web application access logs for unusual cross-origin requests or data exfiltration patterns that correlate with iOS Chrome traffic. Endpoint Detection and Response (EDR) tools with iOS support may flag suspicious script execution, but most organizations lack such visibility on personal or BYOD devices. Focus on patch compliance reporting rather than runtime detection.

Why prioritize this

While the CVSS score of 4.3 (Medium) might suggest lower priority, the vulnerability warrants timely attention due to its confidentiality impact on iOS users, the broad user base of Chrome, and the ease of exploitation via social engineering. iOS devices often handle sensitive tasks (banking, email, corporate apps), making data leakage material. The lack of active exploitation in the wild (KEV status: false) reduces urgency slightly, but organizations should still treat this as a standard medium-priority patch within a 30-day window.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and user interaction required (UI:R), resulting in low confidentiality impact but no integrity or availability loss (I:N, A:N). The scope remains unchanged (S:U), indicating the attacker cannot elevate privileges beyond their own context. The score appropriately captures the practical risk: real but constrained by the social engineering requirement and limited blast radius (iOS-only, data exposure rather than system compromise). Chromium's own assessment of Medium severity aligns with this rating.

Frequently asked questions