CVE-2026-13818: Google Chrome Auth Bypass Vulnerability

CVE-2026-13818 Overview

CVE-2026-13818 is a navigation restriction bypass in the Passwords component of Google Chrome. The flaw exists in Chrome versions prior to 150.0.7871.47. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to bypass navigation restrictions enforced by the browser's password handling logic. Chromium classifies the internal security severity as High, while NVD assigns a medium score reflecting the required user interaction. The weakness maps to [CWE-284] Improper Access Control.

Critical Impact
Attackers can bypass Chrome navigation restrictions through a crafted HTML page, enabling potential credential-targeted redirection and integrity impact against the browser's password subsystem.

Affected Products

Google Chrome desktop versions prior to 150.0.7871.47
Chromium-based browsers embedding vulnerable Passwords component code
Systems running Chrome Stable channel before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-13818 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13818

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords component, which manages saved credentials and controls navigation flows tied to password autofill and management surfaces. An inappropriate implementation permits a crafted HTML page to circumvent navigation restrictions the browser normally enforces around this trusted context. The result is an integrity impact on browser behavior without a direct confidentiality or availability effect, according to the CVSS vector published by NVD. Exploitation requires the victim to interact with attacker-controlled content, such as visiting a malicious page. The EPSS probability at publication is 0.272%, placing exploitation likelihood in the lower percentile range.

Root Cause

The root cause is an access control weakness [CWE-284] in the Passwords component. Chrome fails to correctly validate navigation origin or state when the Passwords surface is engaged. This allows attacker-controlled markup to influence transitions the browser should otherwise restrict. Google's public advisory does not disclose the specific code path, and the Chromium issue tracker entry remains restricted.

Attack Vector

Exploitation occurs over the network with low complexity and no privileges required. The victim must render a crafted HTML page under attacker control. Once rendered, the page manipulates the vulnerable navigation logic to reach restricted destinations or bypass safeguards intended to isolate the Passwords surface from arbitrary web content. Detailed proof-of-concept code is not publicly available. Refer to the Google Chrome Desktop Update advisory for the vendor's disclosure.

Detection Methods for CVE-2026-13818

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 in enterprise inventory
Outbound navigation events from browsers to unexpected domains immediately following Passwords UI interaction
Unusual referrer chains originating from password autofill or management flows

Detection Strategies

Inventory endpoint browser versions and flag any Chrome installation below 150.0.7871.47
Correlate browser telemetry with proxy and DNS logs to identify anomalous redirects following credential prompts
Hunt for HTML artifacts that manipulate chrome:// navigation or password-manager surfaces in email and web gateway captures

Monitoring Recommendations

Enforce browser version compliance checks through endpoint management platforms
Ingest browser process and network telemetry into a centralized data lake for cross-source correlation, such as Singularity Data Lake with OCSF normalization
Alert on execution of outdated chrome.exe binaries on managed endpoints via Singularity Endpoint behavioral telemetry

How to Mitigate CVE-2026-13818

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force a browser restart after deployment to ensure the patched binaries are loaded
Audit endpoints with delayed update channels and prioritize remediation for high-value users

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog. Administrators should deploy Chrome 150.0.7871.47 or newer. Chromium-derived browsers should apply their vendors' equivalent updates once available.

Workarounds

Restrict web browsing to trusted domains through enterprise proxy allowlists until patching completes
Disable Chrome's saved-password feature via group policy for high-risk user populations pending update
Advise users to avoid interacting with password prompts on untrusted pages

bash

# Configuration example: enforce minimum Chrome version via policy
# Windows registry policy example
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.47" /f