CVE-2026-13889: Google Chrome Information Disclosure Flaw

CVE-2026-13889 Overview

CVE-2026-13889 is a side-channel information leakage vulnerability in the WebAuthentication component of Google Chrome on iOS. The flaw affects versions of Chrome on iOS prior to 150.0.7871.47. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Chromium classifies this issue at medium severity, and it is tracked under [CWE-20: Improper Input Validation]. The vulnerability requires user interaction but no privileges or authentication. Successful exploitation compromises confidentiality of data from other origins loaded in the browser.

Critical Impact
A remote attacker can leak cross-origin data from Chrome on iOS via a malicious webpage, breaching the same-origin policy that isolates web content.

Affected Products

Google Chrome on iOS prior to 150.0.7871.47
Apple iPhone OS (as the underlying platform)
Chromium-based WebAuthentication implementations on iOS

Discovery Timeline

2026-06-30 - CVE-2026-13889 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13889

Vulnerability Analysis

The vulnerability resides in the WebAuthentication (WebAuthn) implementation within Google Chrome for iOS. WebAuthn is the browser API that enables passwordless and multi-factor authentication using public-key cryptography. The bug allows a side-channel to leak information across origin boundaries. Attackers exploit this leakage to infer data belonging to a different origin than the one hosting the malicious page. Because the flaw is network-accessible and requires only user interaction to visit a page, phishing and malvertising are practical delivery paths. The exploit vector operates within the browser sandbox and does not require code execution on the host device.

Root Cause

The root cause is improper input validation in the WebAuthentication code path, tracked as [CWE-20]. Timing or state-based observable differences during WebAuthn processing expose cross-origin data. Chrome on iOS did not sufficiently isolate the observable behavior of WebAuthn operations between origins, enabling inference attacks. Google addressed the issue in Chrome 150.0.7871.47 for iOS.

Attack Vector

An attacker hosts a crafted HTML page containing JavaScript that invokes WebAuthentication APIs while measuring side-channel signals. When a victim visits the page in a vulnerable Chrome on iOS build, the attacker's script observes differences that reveal information about other origins. No authentication or elevated privileges are required, but user interaction, visiting the page, is necessary. The vulnerability enables confidentiality violations only; integrity and availability are not directly impacted. Refer to the Chromium Issue Tracker Entry for further technical context.

Detection Methods for CVE-2026-13889

Indicators of Compromise

Chrome on iOS clients running versions earlier than 150.0.7871.47 connecting to untrusted domains
Web sessions issuing repeated or unusual navigator.credentials.get() and WebAuthn ceremony calls from a single origin
Outbound traffic to newly registered domains hosting HTML pages that trigger WebAuthn prompts unexpectedly

Detection Strategies

Inventory mobile browser versions across managed iOS devices and flag Chrome builds below 150.0.7871.47
Correlate browser telemetry with proxy and DNS logs to identify visits to suspicious pages invoking WebAuthn APIs
Monitor mobile threat defense alerts for anomalous credential API activity originating from third-party sites

Monitoring Recommendations

Enable browser version reporting through mobile device management (MDM) to track patch adoption
Log and review WebAuthn ceremony failures and abnormal frequencies in identity provider logs
Alert on user reports of unexpected authentication prompts while browsing on iOS

How to Mitigate CVE-2026-13889

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store
Push the updated Chrome build to managed iOS devices via MDM as soon as it is available
Instruct users to avoid clicking untrusted links until the update is applied

Patch Information

Google released a fixed build in Chrome 150.0.7871.47 for iOS. Details are published in the Google Chrome Release Update. The corresponding tracker record is available in the Chromium Issue Tracker Entry.

Workarounds

Use an alternative up-to-date browser on iOS until Chrome is patched
Restrict access to sensitive web applications that rely on WebAuthn from unpatched Chrome iOS clients via conditional access policies
Educate users to avoid visiting untrusted sites and to close Chrome tabs after WebAuthn ceremonies with sensitive services

bash

# Configuration example: verify installed Chrome version via MDM query
# On iOS, Chrome version can be inspected in Settings > Chrome > Google Chrome
# Ensure the installed version is >= 150.0.7871.47