CVE-2026-13905: Chrome for iOS Information Disclosure Flaw

CVE-2026-13905 Overview

CVE-2026-13905 is a race condition vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw allows a local attacker with physical access to the device to read potentially sensitive information from process memory. Chromium security assigned this issue a Medium severity rating. The weakness is categorized under CWE-362, which covers concurrent execution using shared resources with improper synchronization. Exploitation requires physical access and high attack complexity, which limits practical risk in most enterprise environments. The vulnerability affects confidentiality only and does not enable code execution or integrity impact.

Critical Impact
A local attacker with physical device access can exfiltrate sensitive data residing in Chrome for iOS process memory.

Affected Products

Google Chrome for iOS prior to version 150.0.7871.47
Apple iPhone OS (as the host platform for Chrome for iOS)
All Chrome for iOS deployments not updated to the fixed release

Discovery Timeline

2026-06-30 - CVE-2026-13905 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13905

Vulnerability Analysis

The vulnerability stems from a race condition in Chrome for iOS. Race conditions occur when the correctness of a computation depends on the relative timing of concurrent operations accessing shared resources. In this case, unsynchronized access to memory regions permits a local attacker to observe transient states that expose sensitive process data.

The attacker must have physical access to an unlocked device running a vulnerable Chrome for iOS build. Exploitation complexity is high because the attacker must reliably win the race window. Successful exploitation reveals information residing in browser process memory, which may include authentication tokens, cached credentials, cookies, or page content.

The fix ships in Chrome for iOS 150.0.7871.47. Google has not disclosed exploitation in the wild, and no public proof-of-concept exists at this time. The EPSS score indicates a low near-term exploitation probability.

Root Cause

The root cause is improper synchronization between concurrent operations in Chrome for iOS ([CWE-362]). Missing or insufficient locking around a shared memory resource creates a Time-of-Check Time-of-Use (TOCTOU) window that a local actor can leverage to read privileged data.

Attack Vector

The attack vector is Physical. An attacker must have direct, hands-on access to the target iOS device. Remote exploitation is not possible. The attacker interacts with the browser locally to trigger the racing code paths and capture leaked memory content.

No verified code examples are available for CVE-2026-13905. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor-provided technical context.

Detection Methods for CVE-2026-13905

Indicators of Compromise

Chrome for iOS installations reporting a version earlier than 150.0.7871.47 in mobile device management (MDM) inventory.
Unexpected physical access events to corporate iOS devices, particularly around lost, stolen, or unattended handsets.
Anomalous authentication activity from accounts previously used within Chrome for iOS on an affected device.

Detection Strategies

Query MDM or unified endpoint management (UEM) platforms for Chrome for iOS build numbers and flag any device running below 150.0.7871.47.
Correlate device custody events (lost, recovered, repaired) with subsequent identity provider sign-in anomalies to detect potential post-compromise credential reuse.
Monitor for session token replay or impossible-travel logins tied to accounts that authenticated through Chrome for iOS.

Monitoring Recommendations

Enable centralized logging of iOS device compliance state and browser version reporting through MDM.
Track sign-in telemetry from identity providers for accounts associated with mobile browsers, watching for token reuse from unexpected locations.
Audit physical asset custody workflows to ensure timely reporting of lost or stolen devices.

How to Mitigate CVE-2026-13905

Immediate Actions Required

Update Chrome for iOS to version 150.0.7871.47 or later on all managed devices through the Apple App Store or MDM-driven deployment.
Enforce device passcode, biometric authentication, and automatic lock policies to reduce physical access exposure.
Rotate credentials and revoke active sessions for any account used on a device that experienced unauthorized physical access.

Patch Information

Google addressed CVE-2026-13905 in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Update Announcement and the associated Chromium Issue Tracker Entry. Deploy the update through MDM to enforce compliance across the fleet.

Workarounds

Enforce strong device lock policies (six-digit or alphanumeric passcode, Face ID, Touch ID) to block physical access-based exploitation.
Restrict use of Chrome for iOS on high-risk devices until the patched build is confirmed installed via MDM inventory.
Enable remote wipe capabilities and require immediate reporting of lost or stolen devices to shorten attacker dwell time.

bash

# Example MDM compliance query (Jamf Pro Classic API) to identify vulnerable Chrome for iOS installs
curl -s -u "$JAMF_USER:$JAMF_PASS" \
  -H "Accept: application/xml" \
  "https://your.jamfcloud.com/JSSResource/mobiledeviceapplications/bundleid/com.google.chrome.ios" \
  | xmllint --xpath "//mobile_device_application/general/version" -

# Flag any returned version lower than 150.0.7871.47 for remediation