CVE-2026-13812: Google Chrome iOS XSS Vulnerability

CVE-2026-13812 Overview

CVE-2026-13812 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw stems from insufficient validation of untrusted input in the iOS-specific Chrome codebase. A remote attacker who convinces a user to perform specific UI gestures on a crafted HTML page can inject arbitrary scripts or HTML into the context of another origin. Google's Chromium security team rates the underlying severity as High, while the NVD CVSS 3.1 score is 4.7. The weakness is categorized as [CWE-20] Improper Input Validation.

Critical Impact
Successful exploitation allows cross-origin script injection, enabling session theft, credential harvesting, and account takeover across trusted web applications loaded in Chrome for iOS.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iPhone OS (iOS) hosting vulnerable Chrome builds
Any web application accessed through vulnerable Chrome for iOS installations

Discovery Timeline

2026-06-30 - CVE-2026-13812 published to the National Vulnerability Database
2026-07-01 - Entry last modified in NVD

Technical Details for CVE-2026-13812

Vulnerability Analysis

CVE-2026-13812 is a Universal Cross-Site Scripting flaw specific to Chrome for iOS. UXSS differs from classical XSS because the injection does not depend on a vulnerable target site. The browser itself fails to enforce the Same-Origin Policy correctly, allowing attacker-controlled markup to execute in the security context of an unrelated origin.

Exploitation requires user interaction. The attacker must lure a victim to a crafted HTML page and convince them to perform specific UI gestures within the Chrome for iOS interface. Once triggered, the malicious content bypasses origin boundaries and runs script in the context of a target application. Impact includes reading authenticated session data, exfiltrating cookies not marked HttpOnly, and issuing state-changing requests as the victim.

The EPSS probability for exploitation is 0.184%.

Root Cause

The root cause is insufficient validation of untrusted input inside Chrome for iOS. Because iOS forces all browsers to use the WebKit rendering engine, Chrome for iOS wraps WebKit with its own UI and navigation logic. This wrapper layer failed to sanitize or correctly scope input tied to certain gesture-driven flows, allowing script or HTML supplied by an attacker to be attributed to the wrong origin.

Attack Vector

The attack is network-based and requires no privileges. The attacker hosts a crafted HTML page and directs the victim to it through phishing, malvertising, or a compromised site. The victim must then execute specific UI gestures for the payload to trigger. High attack complexity reflects the reliability challenges of chaining gesture-based triggers with cross-origin injection.

No verified public exploit code is available. The vulnerability mechanism is described in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13812

Indicators of Compromise

Chrome for iOS clients reporting a User-Agent version below 150.0.7871.47 in web server logs.
Unexpected cross-origin script execution or DOM modifications observed in web application telemetry from iOS Chrome sessions.
Outbound requests from authenticated sessions to unfamiliar domains immediately after a user visited an external link on a mobile device.

Detection Strategies

Inventory managed iOS devices and enumerate installed Chrome build numbers through mobile device management (MDM) reporting.
Deploy Content Security Policy (CSP) with strict script-src and report-uri directives to surface unauthorized script execution across sensitive web properties.
Correlate web application authentication anomalies with client platform metadata to isolate iOS Chrome sessions exhibiting UXSS-consistent behavior.

Monitoring Recommendations

Monitor CSP violation reports for script sources that do not match expected first-party or vendor domains.
Track session token reuse from geographically or device-fingerprint inconsistent iOS clients.
Alert on Chrome for iOS versions older than 150.0.7871.47 connecting to internal SaaS and identity provider portals.

How to Mitigate CVE-2026-13812

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store.
Enforce a minimum Chrome for iOS version through MDM compliance policies for corporate-managed devices.
Communicate targeted guidance to users advising caution with unsolicited links and unexpected gesture prompts on mobile browsers.

Patch Information

Google released the fix in Chrome for iOS 150.0.7871.47. Refer to the Google Chrome Stable Update advisory for release details. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict access to sensitive web applications from iOS Chrome clients running versions older than 150.0.7871.47 using conditional access rules.
Direct users to alternative browsers on iOS until patched Chrome builds are confirmed deployed.
Harden web applications with strict Content Security Policy, SameSite=Strict cookies, and HttpOnly session flags to reduce UXSS impact.

bash

# Example conditional access rule (pseudocode) blocking vulnerable Chrome iOS builds
if user_agent.browser == "CriOS" and user_agent.version < "150.0.7871.47":
    deny_access(reason="CVE-2026-13812 - update Chrome for iOS")