CVE-2026-13964: Chrome WebView Navigation Bypass on Android

Technical summary

CVE-2026-13964 is a policy enforcement vulnerability in WebView, Chrome's embedded browser component used by Android applications. The vulnerability stems from insufficient validation of navigation policies, categorized under CWE-284 (Improper Access Control). An attacker can craft a malicious HTML page that, when loaded by a vulnerable WebView instance, bypasses intended navigation restrictions. The attack requires user interaction (clicking a link or visiting the page) and does not result in code execution or information disclosure on its own, but enables navigation to destinations that security policies should have blocked. This could facilitate phishing, credential harvesting, or malware delivery by making it appear the user has navigated to a legitimate destination when they haven't.

Business impact

Organizations using Chrome or Android devices face a risk that users could be deceived into navigating to attacker-controlled or malicious domains that should have been restricted by enterprise policies. This undermines security policies meant to prevent access to phishing sites, malware repositories, or competitor infrastructure. While the vulnerability doesn't directly steal data or execute code, it enables social engineering and policy bypass attacks that could lead to credential compromise, malware infection, or unauthorized access to restricted resources. The impact scales with the number of Android devices and the sensitivity of the web destinations users interact with.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. This affects millions of Android devices globally that run Chrome as the default or alternative browser. Additionally, any third-party Android application that embeds WebView—a common practice—may inherit this vulnerability if it relies on the system WebView component for in-app browsing. Organizations must inventory both direct Chrome installations and applications that leverage WebView functionality.

Exploitability

Exploitation requires user interaction; an attacker must trick a user into visiting or clicking a link to a crafted HTML page. No authentication is required, and the attack can be delivered via email, messaging, or malicious advertisements. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects network accessibility with low complexity but mandatory user engagement. While exploitability is straightforward from a technical standpoint, real-world impact depends on social engineering effectiveness. The vulnerability is not known to be exploited in the wild based on current intelligence.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. For enterprise environments, enforce automated Chrome updates through mobile device management (MDM) policies. Developers who embed WebView should verify their Android system WebView component is patched; the fix is typically delivered through Google Play System Updates. No workaround exists short of disabling WebView or restricting user browsing, so patching is the primary mitigation.

Patch guidance

Apply Chrome for Android version 150.0.7871.47 or later as soon as feasible. Users can check their Chrome version in Settings > About Chrome, which will automatically check for and offer updates. Enterprise administrators should deploy updates through MDM solutions with mandatory compliance timelines. For applications embedding WebView, ensure the system WebView package (com.google.android.webview) is updated via Google Play; this is typically automatic but can be manually verified in the Play Store. Test updates in a limited deployment first to confirm application compatibility.

Detection guidance

Monitor Chrome and WebView version compliance across your device fleet using MDM solutions or endpoint management platforms. Network detection is limited since the attack manifests as legitimate HTTPS traffic to a user-specified domain. Behavioral detection could flag unusual navigation patterns or rapid redirects through blocked domains, but signatures depend on your proxy/gateway configurations. User reporting remains valuable—educate users to report unexpected navigation behavior or suspicious domains appearing in their browser history. Log review of WebView crashes or policy violations may surface exploitation attempts in some logging contexts.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM CVSS score because it directly undermines browser security policies relied upon for enterprise and personal safety. Navigation restriction bypasses have been a historical attack vector for phishing and malware delivery. The ease of exploitation (user interaction only, no special tools) and broad footprint (millions of Android devices) elevate its practical risk. While not immediately critical like remote code execution bugs, it should be prioritized within a 30-day patching window to limit the window for social engineering attacks.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high integrity impact (users navigated to unintended destinations) with no confidentiality or availability loss. The attack vector is network-based and requires low complexity, but mandatory user interaction reduces the attack probability. Chromium's security severity rating of Medium aligns with the CVSS assessment. The score does not account for downstream risk—successful navigation bypasses may enable phishing or malware deployment, amplifying business impact beyond the raw CVSS metric.

Frequently asked questions