CVE-2026-13822: Chrome Android Extension Auth Bypass Flaw

CVE-2026-13822 Overview

CVE-2026-13822 is an inappropriate implementation vulnerability in the Extensions component of Google Chrome on Android. Versions prior to 150.0.7871.47 allow an attacker who convinces a user to install a malicious extension to bypass the same origin policy through a crafted Chrome Extension. The flaw is classified under [CWE-346] (Origin Validation Error) and carries a Chromium security severity rating of High. Successful exploitation lets an attacker read or manipulate data belonging to other web origins, undermining a core browser security boundary.

Critical Impact
An attacker-controlled extension can cross same origin policy boundaries and access data from unrelated web origins on the victim device.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based mobile browsers reusing the affected extensions implementation
Any deployment relying on Chrome Extensions isolation on Android

Discovery Timeline

2026-06-30 - CVE-2026-13822 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13822

Vulnerability Analysis

The vulnerability resides in how Chrome on Android implements the Extensions subsystem. The same origin policy (SOP) is the browser primitive that prevents a document loaded from one origin from reading or modifying data belonging to another origin. Because of an inappropriate implementation in the extension execution path, a crafted extension can access resources across origin boundaries that SOP should protect.

The attack requires user interaction: the victim must be persuaded to install the malicious extension. Once installed, the extension operates with elevated capabilities within the browser and can leverage the flaw to reach data from origins the user has visited or is currently visiting. The impact is scoped to integrity of cross-origin data, with no direct availability impact.

Root Cause

The root cause is an origin validation error [CWE-346] in the Chrome Extensions implementation on Android. Origin checks that gate cross-origin resource access are either missing or incorrectly enforced along an extension code path, letting a malicious extension bypass isolation guarantees. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation proceeds over the network with low complexity but requires user interaction. An attacker publishes or sideloads a crafted Chrome Extension on Android and convinces the target to install it. On execution, the extension issues requests or interacts with browser APIs in a manner that evades same origin enforcement, exfiltrating or modifying data belonging to other origins.

No verified public exploit code is available. Technical background is described in the Google Chrome Stable Update advisory and the linked Chromium issue.

Detection Methods for CVE-2026-13822

Indicators of Compromise

Installation of unfamiliar Chrome extensions on managed Android devices, particularly outside official distribution channels
Extension-initiated network requests to origins unrelated to the user's active browsing session
Unexpected cross-origin data access patterns recorded in browser telemetry or proxy logs

Detection Strategies

Inventory installed Chrome extensions across the mobile fleet and flag any not on an approved allow list
Correlate mobile browser version telemetry against 150.0.7871.47 to identify unpatched endpoints
Review enterprise browser policies and mobile device management (MDM) logs for extension install events preceded by social engineering signals

Monitoring Recommendations

Forward Chrome and Android telemetry to a central analytics platform to alert on extension installations and unusual cross-origin traffic
Track outbound web traffic from mobile devices for requests carrying session cookies or tokens toward attacker-controlled infrastructure
Monitor phishing campaigns and lures that direct users to install browser extensions on Android

How to Mitigate CVE-2026-13822

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later on all managed and personal devices
Audit installed extensions and remove any that are unknown, unused, or sourced outside the official Chrome Web Store
Restrict extension installation on enterprise Android devices through MDM policy
Notify users about extension-based social engineering and enforce approval workflows for new extensions

Patch Information

Google released the fix in the Chrome stable channel. Upgrade Chrome on Android to 150.0.7871.47 or newer. Release notes are available in the Google Chrome Stable Update announcement, and the underlying defect is tracked in the Chromium Issue Tracker Entry.

Workarounds

Block extension installation on Android via enterprise policy until patching is complete
Maintain an allow list of vetted extensions and remove all others from managed devices
Segment browsing of sensitive web applications onto devices without third-party extensions installed

bash

# Example Chrome enterprise policy to restrict extensions on Android
# Deploy via MDM as Chrome managed configuration
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionInstallSources": ["https://chromewebstore.google.com/*"]
}