CVE-2026-13881: Google Chrome Auth Bypass Vulnerability

CVE-2026-13881 Overview

CVE-2026-13881 is a same-origin policy bypass in the WebAppInstalls component of Google Chrome prior to version 150.0.7871.47. The vulnerability stems from an inappropriate implementation classified under [CWE-346] Origin Validation Error. A remote attacker can exploit this flaw by luring a user to a crafted HTML page, allowing cross-origin data to be read or manipulated in violation of browser isolation guarantees. Google Chrome rates this issue as Medium severity. Affected desktop platforms include Windows, macOS, and Linux builds of Chrome. Google addressed the issue in a Stable Channel update published on the Chrome Releases blog.

Critical Impact
Attackers can bypass the same-origin policy through a crafted web page, undermining cross-origin isolation and enabling unauthorized interaction with content from other origins.

Affected Products

Google Chrome versions prior to 150.0.7871.47 on Microsoft Windows
Google Chrome versions prior to 150.0.7871.47 on Apple macOS
Google Chrome versions prior to 150.0.7871.47 on Linux

Discovery Timeline

2026-06-30 - CVE-2026-13881 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13881

Vulnerability Analysis

The defect resides in the WebAppInstalls feature of Chromium, which handles installation flows for Progressive Web Apps (PWAs) and other web-based applications. An inappropriate implementation in this component fails to correctly enforce origin boundaries during the install flow. As a result, content served from one origin can influence or access resources tied to a different origin, breaking the same-origin policy that Chrome uses to isolate web content.

Same-origin policy bypasses in browsers typically enable attackers to read authenticated responses, extract session tokens, or manipulate DOM state belonging to a victim origin. Because the attack requires only a crafted HTML page and user interaction, exploitation can be delivered through phishing links, malicious advertisements, or compromised third-party content. The confidentiality impact reported for this specific issue is limited, but integrity impact is high, indicating the flaw can be used to alter or inject state across origin boundaries.

Root Cause

The root cause is an origin validation error [CWE-346] within the WebAppInstalls code path. The component does not adequately verify that the origin invoking install-related APIs matches the origin of the target resource, allowing origin confusion.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and convinces a victim running a vulnerable Chrome build to visit it. Once the page loads, the flawed WebAppInstalls flow can be invoked to cross the same-origin boundary. No prior authentication or elevated privileges are required on the target.

No verified public proof-of-concept or exploit code is available. Refer to the Chromium Issue Tracker Entry once access restrictions are lifted for technical specifics.

Detection Methods for CVE-2026-13881

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 on managed endpoints
Outbound connections from Chrome to unfamiliar domains immediately followed by unexpected PWA install prompts or manifest fetches
Browser telemetry showing cross-origin manifest.json requests originating from unrelated top-level sites

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build below 150.0.7871.47
Monitor web proxy logs for HTML pages that trigger beforeinstallprompt events combined with cross-origin resource loads
Correlate phishing email delivery with subsequent Chrome navigation events to attacker-controlled URLs

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for version compliance reporting
Alert on Chrome auto-update failures that leave endpoints on outdated builds
Track user reports of unexpected web app install dialogs, which may indicate targeted exploitation attempts

How to Mitigate CVE-2026-13881

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Verify that Chrome auto-update is enabled and functioning through enterprise policy
Restart Chrome after the update installs so the patched binary is loaded into memory

Patch Information

Google released the fix in the Stable Channel desktop update announced on the Google Chrome Desktop Update blog. Administrators should confirm deployment by checking chrome://version on managed hosts and validating that the reported version is 150.0.7871.47 or higher.

Workarounds

Restrict access to untrusted websites through enterprise web filtering until Chrome is patched
Disable web app installation via the WebAppInstallForceList and related enterprise policies where PWAs are not required
Instruct users to avoid clicking install prompts on unfamiliar sites and to report unexpected dialogs

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows registry policy to disable default web app installation
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebAppInstallForceList /t REG_SZ /d "[]" /f