CVE-2026-13904: Google Chrome Auth Bypass Vulnerability

CVE-2026-13904 Overview

CVE-2026-13904 is a medium-severity navigation restriction bypass in the Safe Browsing component of Google Chrome on iOS. The flaw stems from an inappropriate implementation that allows a remote attacker to bypass Safe Browsing navigation restrictions using a crafted HTML page. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page. The vulnerability affects Google Chrome on iOS versions prior to 150.0.7871.47. It is tracked under CWE-693: Protection Mechanism Failure and carries a CVSS 3.1 score of 6.5.

Critical Impact
A remote attacker can bypass Safe Browsing protections on iOS Chrome, exposing users to malicious navigation targets that would otherwise be blocked.

Affected Products

Google Chrome on iOS prior to 150.0.7871.47
Apple iPhone OS (Chrome iOS client)
Any iOS device running vulnerable Chrome builds

Discovery Timeline

2026-06-30 - CVE-2026-13904 published to NVD
2026-07-01 - Last updated in NVD database
June 2026 - Google releases fix in the Chrome Stable Channel Update

Technical Details for CVE-2026-13904

Vulnerability Analysis

The issue resides in the Safe Browsing subsystem of Chrome for iOS. Safe Browsing enforces navigation restrictions that block users from reaching pages associated with phishing, malware, or unwanted software. In vulnerable builds, the enforcement logic can be circumvented when the browser processes a specially crafted HTML page. The bypass permits navigation to destinations that Safe Browsing would normally interrupt with a warning interstitial.

Because the flaw is classified as a protection mechanism failure (CWE-693), the underlying browser engine still functions as designed. The security control simply fails to trigger under attacker-controlled conditions. The CVSS vector reflects high integrity impact with no confidentiality or availability impact, aligning with a bypass that steers users to unintended content.

Root Cause

The root cause is an inappropriate implementation in the Safe Browsing check path on iOS. The check does not consistently intercept navigations initiated by a crafted HTML page, allowing the request to proceed. Refer to the Chromium Issue Tracker entry for developer-facing details.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a Chrome iOS user to open it, for example through a phishing link, malicious advertisement, or compromised website. When the victim interacts with the page, the crafted markup drives a navigation that evades the Safe Browsing interstitial. The attacker can then deliver phishing content, credential harvesting pages, or drive-by download prompts that iOS users would ordinarily be warned about.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.264%.

Detection Methods for CVE-2026-13904

Indicators of Compromise

Chrome iOS clients on versions below 150.0.7871.47 reaching URLs previously flagged in Safe Browsing telemetry.
Web traffic to known phishing or malware domains originating from iOS Chrome user agents without preceding interstitial warnings.
Referrer chains showing navigation from newly registered or low-reputation HTML pages directly to credential collection forms.

Detection Strategies

Inventory managed iOS devices and identify Chrome installations reporting a version string prior to 150.0.7871.47.
Correlate secure web gateway or DNS logs with Google Safe Browsing threat feeds to spot iOS Chrome sessions that reached blocklisted destinations.
Hunt for anomalous navigation patterns in mobile browser telemetry, particularly single-click transitions from unknown domains to authentication pages.

Monitoring Recommendations

Enable mobile threat defense telemetry on iOS fleets to capture browser version data and navigation events.
Ingest proxy, DNS, and mobile device management (MDM) logs into a central analytics platform for cross-source correlation.
Alert on repeated visits by iOS Chrome clients to domains categorized as phishing, malware, or newly observed.

How to Mitigate CVE-2026-13904

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store.
Push a mandatory update policy via MDM to ensure managed iOS devices receive the fixed Chrome build.
Communicate with users to close and reopen Chrome after the update so the new version is active.

Patch Information

Google addressed CVE-2026-13904 in Chrome for iOS 150.0.7871.47. Details are published in the Google Chrome Stable Update announcement, with tracking in the Chromium Issue Tracker Entry. Apply the update across all iOS devices where Chrome is installed.

Workarounds

Use an alternative browser on iOS with active phishing and malware protections until Chrome is updated.
Enforce DNS-layer filtering or secure web gateway policies that block known malicious domains independent of the browser.
Deliver end-user awareness reminders about phishing links delivered via email, messaging, or advertisements.

bash

# Verify Chrome iOS version via MDM query (example: Jamf Pro)
# Query installed app version and flag devices below the fixed build
APP_BUNDLE_ID="com.google.chrome.ios"
FIXED_VERSION="150.0.7871.47"

jamf recon -endUsername "$USER"
# Review results in Jamf > Devices > Search Inventory > Applications
# Filter: Application Bundle ID = com.google.chrome.ios
# Alert on: Application Version < 150.0.7871.47