CVE-2026-13847: Google Chrome Information Disclosure Flaw

CVE-2026-13847 Overview

CVE-2026-13847 is an input validation vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw stems from insufficient validation of untrusted input in the Chrome for iOS component, allowing a remote attacker to leak cross-origin data through a crafted HTML page. Chromium classifies the security severity as High, while the NVD assigns a CVSS 3.1 score of 6.5. Exploitation requires user interaction, typically by convincing a target to visit an attacker-controlled web page. The weakness is tracked under [CWE-20] (Improper Input Validation).

Critical Impact
Remote attackers can exfiltrate cross-origin data from Chrome for iOS users by luring them to a malicious HTML page, breaking the Same-Origin Policy that isolates web content between sites.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iPhone OS (host platform for the affected Chrome build)
Any iOS device running vulnerable Chrome versions

Discovery Timeline

2026-06-30 - CVE-2026-13847 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13847

Vulnerability Analysis

CVE-2026-13847 is an input validation flaw in Chrome for iOS that undermines cross-origin isolation. Chromium's advisory identifies the vulnerability as a bypass of protections around cross-origin data handling, triggered when the browser processes a crafted HTML page. The attacker does not require authentication or elevated privileges, but the target must load the malicious content in the browser.

The impact is confined to confidentiality. Successful exploitation exposes data belonging to origins other than the attacker's site, such as content, tokens, or state associated with authenticated sessions. Integrity and availability of the browser and host device are not affected. See the Google Chrome Update Announcement for the vendor's advisory.

Root Cause

The root cause is improper validation of untrusted input in the iOS-specific Chrome codebase. Chrome for iOS uses Apple's WebKit engine due to App Store restrictions, so the defect resides in the Chrome layer that mediates content and navigation on top of WebKit. Missing or incomplete checks on input crossing origin boundaries allow attacker-controlled data to influence code paths that should enforce origin separation.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to visit it, for example through phishing, a malicious advertisement, or a compromised site. When the page loads in a vulnerable Chrome for iOS build, embedded logic exercises the input handling flaw to read cross-origin data. The Chromium Issue Tracker Entry references the underlying report.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at the time of publication.

Detection Methods for CVE-2026-13847

Indicators of Compromise

Chrome for iOS clients reporting a user-agent version below 150.0.7871.47 after the patch release date
Outbound requests from mobile devices to newly registered or low-reputation domains immediately after HTML page loads
Unexpected cross-origin fetches or postMessage traffic originating from attacker-controlled pages visited on iOS Chrome

Detection Strategies

Inventory managed iOS devices and identify Chrome installs still on versions prior to 150.0.7871.47 using MDM software inventory reports
Correlate proxy and DNS logs with threat intelligence feeds to flag visits to known malicious HTML lures targeting mobile browsers
Monitor identity provider logs for anomalous session reuse from iOS Chrome user agents, which may indicate leaked cross-origin session data

Monitoring Recommendations

Ingest MDM, proxy, and IdP telemetry into a centralized analytics platform to track Chrome for iOS version drift and suspicious browsing activity
Alert on iOS Chrome sessions that continue reporting vulnerable version strings beyond the organization's patch SLA
Track EPSS movement for CVE-2026-13847 (currently 0.281%) to reprioritize response if exploitation likelihood increases

How to Mitigate CVE-2026-13847

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store on all managed and BYOD devices
Push a forced update policy via MDM to accelerate deployment across the mobile fleet
Notify users to avoid opening untrusted links in Chrome for iOS until the update is confirmed installed

Patch Information

Google addressed CVE-2026-13847 in Chrome for iOS 150.0.7871.47. Refer to the Google Chrome Update Announcement for release notes and the Chromium Issue Tracker Entry for the underlying bug reference. Apply the update through the App Store or an MDM-managed app catalog.

Workarounds

Use an alternative browser on iOS, such as Safari, until the Chrome update is installed on the device
Restrict access to sensitive web applications from iOS Chrome clients reporting versions below 150.0.7871.47 using conditional access policies
Block known malicious domains at the DNS or secure web gateway layer to reduce exposure to crafted HTML lures

bash

# Verify installed Chrome for iOS version via MDM query and enforce update
# Example: Jamf Pro smart group criteria
Application Title is "Google Chrome"
Application Version is less than "150.0.7871.47"
# Action: Scope Managed App Update command to matching devices