CVE-2026-13900: Google Chrome Auth Bypass Vulnerability

CVE-2026-13900 Overview

CVE-2026-13900 is a navigation restriction bypass in the Chromecast component of Google Chrome. The flaw affects Chrome desktop builds prior to 150.0.7871.47. An attacker who has already compromised the renderer process can bypass navigation restrictions by serving a crafted HTML page to the target. The vulnerability is classified under CWE-20: Improper Input Validation and requires user interaction to exploit. Google tracks the underlying defect in the Chromium Issue Tracker Entry and released the fix through the Google Chrome Desktop Update.

Critical Impact
A compromised renderer can bypass Chromecast navigation restrictions, allowing an attacker to redirect or navigate the browser to attacker-controlled destinations that should have been blocked.

Affected Products

Google Chrome for Desktop prior to 150.0.7871.47
Chromium-based builds embedding the vulnerable Chromecast component
Downstream browsers that ship the affected Chromium version without the June 2026 stable-channel patches

Discovery Timeline

2026-06-30 - CVE-2026-13900 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13900

Vulnerability Analysis

The vulnerability resides in the Chromecast implementation inside Chrome. Chromecast integration enforces navigation restrictions that limit where the browser can direct the user during a casting session. The affected code path does not validate navigation requests originating from a compromised renderer with sufficient rigor. As a result, an attacker who chains this flaw with a prior renderer compromise can steer navigation past those restrictions using a crafted HTML page.

The attack requires user interaction, which typically means visiting an attacker-controlled site or interacting with attacker-supplied content. Impact centers on integrity: the browser navigates to destinations the security model was supposed to prevent. Confidentiality and availability are not directly affected, but the bypass enables follow-on attacks such as credential phishing on spoofed domains.

The issue is categorized as [CWE-20], reflecting insufficient validation of input that governs a security-relevant decision. EPSS data on 2026-07-02 places the probability of exploitation at 0.308%.

Root Cause

The root cause is inadequate validation of navigation targets inside the Chromecast component. Trust assumptions about messages or state received from the renderer process allow the restriction check to be bypassed. Because renderer processes are considered untrusted after a compromise, any restriction that relies on renderer-supplied state without independent verification in the browser process is bypassable.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the renderer process, typically via a separate memory corruption or type confusion bug. Second, the victim must load a crafted HTML page that triggers the flawed Chromecast code path. Once both conditions are met, the attacker can issue navigation requests that bypass the enforced restrictions.

No public proof-of-concept or exploit code has been published for CVE-2026-13900. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical background, refer to the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13900

Indicators of Compromise

Chrome browser processes at versions earlier than 150.0.7871.47 running in production environments
Unexpected outbound navigations from browser sessions to domains unrelated to user activity, particularly involving Chromecast-related IPC
Renderer process crashes or sandbox anomalies preceding suspicious navigation events

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build below 150.0.7871.47 as vulnerable.
Correlate web proxy logs with browser telemetry to identify navigations that occur without corresponding user click events.
Hunt for exploit chains by looking for renderer compromise indicators followed by anomalous navigation patterns within the same session.

Monitoring Recommendations

Enable browser management telemetry to report Chrome version and update status to a central console.
Ingest DNS and HTTP proxy logs into a security analytics platform and alert on connections to newly registered or low-reputation domains from browser processes.
Monitor endpoint EDR telemetry for chrome.exe child process spawns and unexpected network destinations that could indicate a chained renderer exploit.

How to Mitigate CVE-2026-13900

Immediate Actions Required

Update Google Chrome on all desktop endpoints to version 150.0.7871.47 or later.
Push the update through enterprise management channels such as Chrome Browser Cloud Management or endpoint configuration tooling to ensure coverage.
Force browser restarts after deployment to guarantee the patched binary is loaded into memory.

Patch Information

Google addressed CVE-2026-13900 in the Chrome stable channel release documented in the Google Chrome Desktop Update. Chromium-based browsers must incorporate the corresponding upstream fix. Verify vendor advisories for Edge, Brave, Opera, and other Chromium derivatives before considering those installations remediated.

Workarounds

Disable Chromecast functionality via enterprise policy where casting is not required for business operations.
Restrict browser access to untrusted sites using DNS filtering or secure web gateway policies until patching is complete.
Enforce site isolation and keep the renderer sandbox enabled to raise the cost of the prerequisite renderer compromise.

bash

# Example: disable Chromecast media routing via Chrome enterprise policy on Linux
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/disable_cast.json
{
  "EnableMediaRouter": false,
  "MediaRouterCastAllowAllIPs": false
}
EOF

# Verify Chrome version meets or exceeds the patched build
google-chrome --version