CVE-2026-13954: Chrome Android XML Policy Bypass & Memory Disclosure

Technical summary

CVE-2026-13954 is a memory disclosure vulnerability stemming from insufficient policy enforcement in Chrome's XML handling on Android. The vulnerability is classified under CWE-284 (Improper Access Control), indicating a failure to properly restrict access to sensitive data. An attacker exploiting this issue can leverage a crafted HTML page to bypass intended security boundaries and access process memory contents that should remain confidential. The attack vector is network-based, requires no privileges, but does depend on user interaction to visit the malicious page. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android devices.

Business impact

This vulnerability poses a confidentiality risk to mobile users of Chrome on Android. Depending on what data resides in process memory at the time of exploitation, sensitive information could be exposed—including cached credentials, session tokens, or data from other running processes. For organizations with bring-your-own-device (BYOD) policies or employees using Chrome on personal Android devices to access corporate resources, this vulnerability could facilitate credential theft or unauthorized access to sensitive information. The requirement for user interaction limits mass exploitation but does not eliminate risk in targeted attack scenarios.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. Desktop and other browser variants are not affected by this particular issue. Organizations should verify the Chrome version installed on Android devices in their mobile device inventory. This includes both managed devices and, if applicable, personal devices with company data access.

Exploitability

The exploit is moderately straightforward to execute: an attacker creates a malicious HTML page and distributes it via email, social engineering, malicious ads, or compromised websites. When a vulnerable Chrome user visits the page, the XML policy enforcement flaw is triggered, allowing memory disclosure. No advanced capabilities or exploitation tools are required beyond basic web development skills. However, the attack is not wormable or self-propagating, and requires active user participation. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been observed or reported at scale.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later as soon as possible. Google typically delivers updates through the Google Play Store; ensure automatic updates are enabled on Android devices. Verify the installed version in Chrome by navigating to Settings > About Chrome. For organizations managing mobile devices via mobile device management (MDM) solutions, enforce a minimum Chrome version policy. Additionally, consider user education on avoiding suspicious links and downloading only apps from official stores.

Patch guidance

Google has released Chrome version 150.0.7871.47 and subsequent versions to address this vulnerability. Patches are available through the Google Play Store. Users should enable automatic app updates in Google Play Store settings (Settings > Apps > Google Play Store > App settings > Auto-update apps). Organizations using MDM platforms should push Chrome updates as mandatory and monitor device compliance. Verify the patch installation by confirming the version number in Chrome Settings > About Chrome displays a version number greater than or equal to 150.0.7871.47.

Detection guidance

Network-based detection is challenging because the attack relies on standard HTTP traffic to a malicious website. However, security teams should monitor for suspicious HTML pages distributed via email or advertising networks. At the endpoint level, monitor for unusual process memory access patterns or unexpected data exfiltration from Chrome processes. On managed Android devices, MDM solutions can detect and flag out-of-date Chrome versions. Consider network segmentation and monitoring for connections to known malicious domains. User reporting of suspicious pages remains a valuable detection mechanism.

Why prioritize this

This vulnerability merits medium-to-high priority due to its combination of network-based attack surface, user interaction requirement, and potential for sensitive data theft. While the CVSS score is 6.5 (Medium), the practical impact depends on organizational risk tolerance for mobile credential exposure and the prevalence of Chrome on Android in the device inventory. Organizations handling sensitive data on mobile devices or supporting BYOD should prioritize patching within days rather than weeks. The absence from the KEV catalog suggests this is not yet an active, widespread threat, but that status can change.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: Attack Vector = Network (AV:N), meaning the flaw is reachable over the network without proximity; Attack Complexity = Low (AC:L), indicating no special conditions are needed beyond a crafted HTML page; Privileges Required = None (PR:N); User Interaction = Required (UI:R), meaning the user must visit the malicious page; Scope = Unchanged (S:U); Confidentiality = High (C:H), as the vulnerability allows unauthorized reading of process memory; Integrity = None (I:N) and Availability = None (A:N), indicating no ability to modify or disrupt systems. The score appropriately captures the memory disclosure risk balanced against the user interaction requirement.

Frequently asked questions