CVE-2026-13795: Google Chrome Auth Bypass Vulnerability

CVE-2026-13795 Overview

CVE-2026-13795 is a policy enforcement weakness in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw allows a remote attacker to bypass navigation restrictions by delivering a crafted HTML page to a target user. Google classified the underlying Chromium security severity as High, while the assigned CVSS 3.1 base score is 6.5. The issue maps to [CWE-602] (Client-Side Enforcement of Server-Side Security) and requires user interaction, typically by loading attacker-controlled content in the browser. Exploitation impacts integrity by permitting the attacker to route navigation outside intended policy boundaries.

Critical Impact
Attackers can bypass navigation restrictions in Chrome for iOS through a crafted web page, undermining browser-enforced policy controls that protect users from unauthorized redirects and cross-origin navigation.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iPhone OS (as the underlying platform)
Chromium-based navigation policy component

Discovery Timeline

2026-06-30 - CVE-2026-13795 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13795

Vulnerability Analysis

The vulnerability stems from insufficient policy enforcement inside Chrome for iOS. Navigation restrictions that should be evaluated and blocked by the browser can be bypassed when a user loads a crafted HTML page. Because the weakness is categorized as [CWE-602], the browser relies on client-side checks that an attacker can circumvent by shaping the page content and navigation flow.

Exploitation is network-reachable and requires user interaction, such as visiting an attacker-controlled site or opening a malicious link. The confidentiality impact is none, but the integrity impact is high because navigation policy is a security boundary. Successful abuse can undermine managed browsing policies, custom URL scheme handling, and restrictions applied through enterprise configurations on iOS.

EPSS currently rates the probability of exploitation at 0.252% (percentile 16.491), and there is no evidence of public exploit code or in-the-wild abuse at time of writing.

Root Cause

The root cause is inadequate enforcement of navigation policy inside the iOS-specific Chrome implementation. Certain navigation paths do not consistently apply the restrictions expected by the security model, allowing crafted HTML to reach destinations the policy should block. See the Chromium Issue Tracker Entry for technical context.

Attack Vector

A remote attacker hosts a crafted HTML page and lures the victim into loading it in Chrome for iOS. The page triggers navigation sequences that evade the browser's restriction checks. No authentication is required, and the attack succeeds after a single user interaction. Delivery typically occurs through phishing links, malicious advertising, or compromised sites.

No verified proof-of-concept code has been published. Refer to the Google Chrome Stable Update advisory for release details.

Detection Methods for CVE-2026-13795

Indicators of Compromise

Chrome for iOS clients reporting a version string below 150.0.7871.47 in telemetry or user-agent logs
Unexpected navigation events from mobile browsers to domains outside allow-listed policy scopes
Inbound web traffic containing crafted HTML that chains meta refresh, JavaScript redirects, and custom URL scheme handlers

Detection Strategies

Inspect web proxy and DNS logs for iOS Chrome user agents visiting newly registered or low-reputation domains that host redirect chains.
Correlate mobile device management (MDM) inventory data with observed Chrome versions to flag devices still on vulnerable builds.
Alert on policy violations from managed browser configurations where navigation controls fail to block previously restricted destinations.

Monitoring Recommendations

Ingest Chrome for iOS version telemetry into your logging platform and build dashboards that highlight builds older than 150.0.7871.47.
Monitor URL filtering gateways for anomalous redirect patterns originating from iOS devices.
Track user click-through events on phishing simulations to identify populations most likely to reach attacker-controlled navigation payloads.

How to Mitigate CVE-2026-13795

Immediate Actions Required

Update Google Chrome for iOS to 150.0.7871.47 or later through the Apple App Store on all managed and personal devices.
Enforce minimum browser version policies through MDM to block outdated Chrome builds from accessing corporate resources.
Communicate the risk to end users and instruct them to avoid opening unsolicited links on mobile devices until updates are applied.

Patch Information

Google addressed CVE-2026-13795 in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Stable Update release notes. Enterprises using MDM should push the updated App Store version and verify installation across their fleet.

Workarounds

Use an alternate iOS browser with current security patches until Chrome is updated on the device.
Restrict mobile browser access to sensitive applications through conditional access policies that require a minimum Chrome version.
Deploy secure web gateway filtering to block known malicious domains and reduce exposure to crafted HTML payloads.

bash

# Example MDM compliance check to flag vulnerable Chrome for iOS builds
# Pseudocode: evaluate installed app version against fixed release
REQUIRED_VERSION="150.0.7871.47"
INSTALLED_VERSION=$(mdm_query --app "com.google.chrome.ios" --field version)

if [ "$(printf '%s\n' "$REQUIRED_VERSION" "$INSTALLED_VERSION" | sort -V | head -n1)" != "$REQUIRED_VERSION" ]; then
  echo "Non-compliant: Chrome for iOS $INSTALLED_VERSION is vulnerable to CVE-2026-13795"
  mdm_action --device "$DEVICE_ID" --policy block-corp-access
fi