CVE-2026-13892: Google Chrome iOS Info Disclosure Flaw

CVE-2026-13892 Overview

CVE-2026-13892 is a cross-origin information disclosure vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation in the Chrome for iOS component and is classified under [CWE-451] as user interface misrepresentation. A remote attacker can leak cross-origin data by serving a crafted HTML page and convincing the user to perform specific UI gestures. Google has rated the Chromium security severity as Medium and shipped a fix in the stable channel update for iOS.

Critical Impact
Successful exploitation allows a remote attacker to leak cross-origin data from other web origins loaded in Chrome for iOS, breaking the browser's same-origin isolation guarantees.

Affected Products

Google Chrome for iOS versions prior to 150.0.7871.47
Apple iPhone OS (iOS) devices running the vulnerable Chrome build
Any deployment of Chrome on iOS that has not received the stable channel update

Discovery Timeline

2026-06-30 - CVE-2026-13892 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13892

Vulnerability Analysis

CVE-2026-13892 is a user interface security flaw in the iOS build of Google Chrome. The vulnerability falls under [CWE-451], covering user interface misrepresentation of critical information. Attackers exploit the flaw by hosting a crafted HTML page and inducing the victim to perform specific UI gestures inside the browser. Those gestures cause Chrome for iOS to expose data belonging to a different web origin than the one under the attacker's control.

Because exploitation requires user interaction, phishing lures, malicious advertising, and compromised web pages remain the most likely delivery paths. The attack vector is Network and no privileges are required. The EPSS score at publication was 0.282%, indicating low observed exploitation activity in the wild.

Root Cause

The root cause is an inappropriate implementation in Chrome for iOS that fails to preserve cross-origin boundaries when specific UI gestures are processed. Chrome derives its iOS build from WebKit rather than Blink, and the affected logic mishandles the security context associated with the gesture handler. The result is a same-origin policy bypass surface that leaks data across origins.

Attack Vector

An attacker hosts a crafted HTML page on an origin they control. The victim visits the page in Chrome for iOS and is guided through interface gestures such as taps, long presses, or navigation actions. During gesture handling, Chrome for iOS returns or exposes content associated with a separate origin, which the attacker's script then exfiltrates. The vulnerability manifests entirely client-side. No verified public proof-of-concept is available. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13892

Indicators of Compromise

Chrome for iOS clients reporting a version string below 150.0.7871.47 in mobile device management (MDM) inventory feeds.
Outbound requests from mobile devices to newly registered domains that host pages designed to prompt repeated user gestures.
Web proxy logs showing cross-origin content being read into attacker-controlled origins immediately after gesture-heavy page interactions.

Detection Strategies

Query MDM and unified endpoint management platforms for Chrome iOS build versions and flag any installation below the patched release.
Inspect HTTP response bodies at egress for pages that request unusual gesture sequences combined with cross-origin fetch or postMessage activity.
Correlate mobile browser telemetry with threat intelligence feeds tracking phishing kits that abuse Chromium UI redressing techniques.

Monitoring Recommendations

Enforce browser version reporting through MDM configuration profiles and alert on out-of-date Chrome iOS installations.
Route iOS device browsing through a secure web gateway that can log referrers, gesture-triggered navigation, and cross-origin script activity.
Track user reports of unexpected content, prompts, or interface behavior inside Chrome for iOS during web browsing.

How to Mitigate CVE-2026-13892

Immediate Actions Required

Update Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store on every managed device.
Push the update through MDM using managed app configuration to accelerate deployment across the fleet.
Communicate the risk to users and instruct them to avoid unfamiliar links and unusual gesture prompts in the browser until patched.

Patch Information

Google addressed CVE-2026-13892 in the Chrome for iOS stable channel release 150.0.7871.47. Deployment details and release notes are available in the Google Chrome Update Announcement. Additional engineering context is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict use of Chrome on iOS to trusted sites until the update is installed, or temporarily switch users to a patched browser build enforced by MDM policy.
Deploy secure web gateway rules that block newly registered or low-reputation domains commonly used for phishing and UI redressing.
Enable browser update enforcement policies in MDM so that devices below 150.0.7871.47 are marked non-compliant and lose access to sensitive resources.

bash

# Configuration example: verify Chrome iOS version via MDM query
# Compliance rule (pseudocode) evaluated by the MDM platform
if app.bundle_id == "com.google.chrome.ios" \
   && app.version < "150.0.7871.47"; then
    device.compliance_status = "non_compliant"
    action.notify_user("Update Google Chrome from the App Store")
    action.block_access("corporate_resources")
fi