CVE-2026-13809: Google Chrome Information Disclosure Issue

CVE-2026-13809 Overview

CVE-2026-13809 is a side-channel information leakage vulnerability in the Safe Browsing component of Google Chrome on iOS. The flaw affects Chrome iOS builds prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page to the victim. Chromium engineers rated the underlying issue as High severity, while NVD scoring places it at 6.5. The weakness is classified under [CWE-1300: Improper Protection of Physical Side Channels], reflecting a design gap in how Safe Browsing lookups interact with cross-origin content on iOS.

Critical Impact
An attacker with a compromised renderer can exfiltrate cross-origin data via a crafted HTML page, breaking the same-origin policy boundary that Chrome relies on to isolate web content.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iOS devices running vulnerable Chrome builds
Safe Browsing component within Chrome iOS

Discovery Timeline

2026-06-30 - CVE-2026-13809 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13809

Vulnerability Analysis

The vulnerability resides in the Safe Browsing subsystem of Chrome on iOS. Safe Browsing checks URLs against a threat database before navigation completes. The check produces observable side effects that vary with the resource being evaluated. An attacker who controls the renderer process can measure these side effects to infer properties of cross-origin resources.

The attack model assumes prior compromise of the renderer. In Chrome's security architecture, the renderer is untrusted and the browser process enforces cross-origin boundaries. This flaw weakens that boundary by allowing the compromised renderer to indirectly observe data from origins it should not be able to read.

The attacker delivers a crafted HTML page that triggers Safe Browsing evaluations against target cross-origin URLs. Timing or state signals returned through the Safe Browsing pathway reveal information about the target resources. This falls under the CWE-1300 category because the leak depends on measurable side-channel behavior rather than a direct read primitive.

Root Cause

The root cause is insufficient isolation between Safe Browsing lookups and renderer-observable state on iOS. Safe Browsing operations do not fully mask signals that a compromised renderer can correlate with cross-origin content. The iOS-specific implementation lacks the mitigations present on other Chrome platforms.

Attack Vector

Exploitation requires network access and user interaction. The victim must load a crafted HTML page in a Chrome iOS session where the renderer has already been compromised, typically through a separate exploit chain. Once loaded, the page executes JavaScript that triggers the side-channel measurement and exfiltrates cross-origin data to the attacker.

The vulnerability mechanism is described in the Chromium Issue Tracker Entry. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-13809

Indicators of Compromise

Chrome iOS clients reporting version strings below 150.0.7871.47 in mobile device management inventory.
Anomalous outbound traffic from mobile browsers to attacker-controlled domains following visits to untrusted HTML content.
Repeated Safe Browsing lookup patterns tied to a single tab that correlate with cross-origin resource fetches.

Detection Strategies

Inventory managed iOS devices and flag Chrome installations older than 150.0.7871.47 via unified endpoint management telemetry.
Correlate mobile browser telemetry with proxy logs to identify sessions that fetch large volumes of cross-origin resources followed by outbound POST traffic to unfamiliar hosts.
Monitor for renderer-compromise precursors such as exploitation of other Chromium CVEs shipped in the same release cycle.

Monitoring Recommendations

Ingest mobile browser version telemetry into the SIEM and alert on installations below the patched build.
Track visits to newly registered or low-reputation domains from managed iOS devices.
Review network egress from mobile fleets for beacon-like patterns tied to browser sessions.

How to Mitigate CVE-2026-13809

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later on every managed device.
Push the updated build through Apple Business Manager or mobile device management to enforce compliance.
Advise users to restart Chrome after the update so the patched binary is loaded.

Patch Information

Google addressed the issue in the Chrome iOS stable channel update referenced in the Google Chrome Stable Update advisory. Version 150.0.7871.47 and later contain the fix for the Safe Browsing side-channel behavior. Confirm the installed build under Chrome's About page or through MDM reporting.

Workarounds

Restrict Chrome usage on iOS to trusted sites through MDM URL filtering until the patch is deployed.
Use Safari or another updated browser for sensitive workflows on iOS devices that cannot be immediately patched.
Disable Chrome on iOS via MDM configuration profiles on high-risk devices pending remediation.

bash

# Configuration example: verify Chrome iOS version via MDM query
# Query the CFBundleShortVersionString for com.google.chrome.ios
# Flag any device where the value is lexically less than 150.0.7871.47
mdm query --bundle-id com.google.chrome.ios --attribute CFBundleShortVersionString