CVE-2026-13816: Google Chrome Information Disclosure Flaw

CVE-2026-13816 Overview

CVE-2026-13816 is an input validation vulnerability in the File Input component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to properly validate untrusted input, enabling a remote attacker to leak cross-origin data through a crafted HTML page. The flaw is classified under CWE-20: Improper Input Validation and requires user interaction to trigger. Chromium security engineers rated the underlying issue as High severity, while NVD assigned a CVSS 3.1 score of 6.5.

Critical Impact
A remote attacker can bypass the same-origin policy and exfiltrate sensitive data from other web origins by luring a Chrome on Android user to a malicious page.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Google Android devices running vulnerable Chrome builds
Chromium-based mobile browsers sharing the affected File Input code path

Discovery Timeline

2026-06-30 - CVE-2026-13816 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13816

Vulnerability Analysis

The vulnerability resides in the File Input handling logic of Chrome on Android. Chrome does not sufficiently validate untrusted input passed through <input type="file"> element interactions. This gap enables a crafted HTML page to manipulate file input flows so that data belonging to another origin becomes observable to the attacker's page.

The issue is a cross-origin information disclosure. It undermines the same-origin policy, which is the primary browser boundary preventing one site from reading another site's data. Successful exploitation exposes confidentiality of user data loaded in other origins, though it does not directly modify data or crash the browser.

Exploitation requires user interaction, typically clicking or otherwise engaging with content on the attacker-controlled page. No authentication or elevated privileges are required. See the Chromium Issue Tracker #511735715 for engineering context.

Root Cause

The root cause is improper validation of input supplied to the File Input component. Chrome's File Input implementation on Android accepts data or state transitions from untrusted contexts without enforcing origin boundaries strictly enough to prevent cross-origin observation.

Attack Vector

The attack is delivered over the network through a crafted HTML page. The attacker hosts a malicious site and induces the victim to visit it using a vulnerable Chrome on Android build. Interaction with the page's file input surface triggers the flaw and leaks cross-origin data back to the attacker.

No verified public proof-of-concept is available. Refer to the Google Chrome Stable Channel Update for release-level details.

Detection Methods for CVE-2026-13816

Indicators of Compromise

Chrome for Android builds reporting versions earlier than 150.0.7871.47 in device inventory or User-Agent telemetry.
Outbound connections from mobile endpoints to unfamiliar domains immediately following file picker interactions in the browser.
Web proxy logs showing crafted HTML pages that reference <input type="file"> elements alongside cross-origin fetches.

Detection Strategies

Inventory Chrome versions across managed Android fleets and flag any endpoint below 150.0.7871.47.
Correlate mobile web traffic with threat intelligence feeds to identify pages known to abuse Chromium file input flows.
Review Mobile Threat Defense (MTD) alerts for anomalous browser behavior on Android devices used to access sensitive web applications.

Monitoring Recommendations

Ingest Chrome version telemetry from Mobile Device Management (MDM) into a centralized SIEM for continuous version drift tracking.
Alert when Android users visit newly registered domains that request file input interactions shortly after account authentication events.
Monitor for unexpected cross-origin data transfers originating from mobile browser sessions.

How to Mitigate CVE-2026-13816

Immediate Actions Required

Update Google Chrome on all Android devices to version 150.0.7871.47 or later through the Google Play Store.
Enforce automatic Chrome updates via MDM policies to prevent version regression.
Advise users to avoid interacting with file upload prompts on untrusted sites until patching is confirmed.

Patch Information

Google addressed the flaw in Chrome 150.0.7871.47 for Android. Distribution is handled through the Google Play Store as part of the stable channel rollout. Details are published in the Google Chrome Stable Channel Update and the Chromium Issue Tracker #511735715.

Workarounds

Restrict use of Chrome on Android for high-sensitivity workflows until patched builds are deployed.
Apply enterprise browser policies that block navigation to untrusted or uncategorized web destinations from managed Android devices.
Use MDM controls to require the minimum Chrome version before granting access to corporate web resources via conditional access.

bash

# Example: enforce minimum Chrome for Android version via MDM managed configuration
# ChromeVariationsRestrictParameter and MinimumChromeVersion are enforced through
# the managed app configuration channel on Android Enterprise.
{
  "MinimumChromeVersion": {
    "Value": "150.0.7871.47"
  },
  "URLBlocklist": {
    "Value": ["*"]
  },
  "URLAllowlist": {
    "Value": ["https://*.corp.example.com"]
  }
}