CVE-2026-13908: Google Chrome Auth Bypass Vulnerability

CVE-2026-13908 Overview

CVE-2026-13908 is an input validation vulnerability in the Omnibox component of Google Chrome on iOS before version 150.0.7871.47. The flaw allows a remote attacker to bypass navigation restrictions when a user is convinced to perform specific UI gestures. Exploitation relies on malicious network traffic combined with user interaction, which limits automated abuse but enables targeted spoofing or navigation manipulation attacks. Google classified the Chromium security severity as Medium. The issue maps to CWE-20: Improper Input Validation and affects Chrome installations running on Apple iOS devices.

Critical Impact
A remote attacker can bypass navigation restrictions in Chrome for iOS by combining malicious network traffic with specific user gestures, enabling potential URL spoofing or unauthorized navigation.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iPhone OS (iOS) devices running affected Chrome builds
Omnibox component within Chrome for iOS

Discovery Timeline

2026-06-30 - CVE-2026-13908 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13908

Vulnerability Analysis

The Omnibox is Chrome's combined address and search bar. It parses user-entered text and untrusted network-supplied data to determine navigation targets. In Chrome for iOS prior to 150.0.7871.47, the Omnibox does not sufficiently validate untrusted input before processing navigation actions. An attacker who can influence page content or network responses can craft input that the Omnibox mishandles when the user performs specific UI gestures. This mishandling permits navigation restrictions to be bypassed, which can facilitate address bar spoofing or navigation to attacker-controlled destinations that would otherwise be blocked. Integrity is the primary security property affected. Confidentiality and availability remain intact under the assessed vector.

Root Cause

The root cause is improper input validation [CWE-20] in the Omnibox's handling of untrusted data received through the network channel. The component accepts input without adequately verifying that it conforms to expected structural and semantic constraints before it is used to drive navigation decisions.

Attack Vector

Exploitation requires a network-adjacent attacker to deliver malicious traffic to a target and to socially engineer the user into performing specific UI gestures. No authentication is required. The attack is remote but depends on user interaction, which is why it is rated Medium rather than High severity. Successful exploitation results in bypassed navigation restrictions in the Chrome iOS browser.

No public proof-of-concept or exploit code is available for CVE-2026-13908. See the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2026-13908

Indicators of Compromise

Chrome for iOS clients reporting a build number lower than 150.0.7871.47 in mobile device management (MDM) inventory.
Unexpected navigation events in browser telemetry where the displayed Omnibox URL does not match the loaded resource.
Outbound connections from mobile endpoints to newly registered or low-reputation domains immediately after user interaction with a suspicious page.

Detection Strategies

Inventory Chrome for iOS versions across managed mobile fleets and flag any device below 150.0.7871.47.
Correlate mobile browser telemetry with web proxy logs to identify navigation mismatches between the URL bar and the resolved destination.
Monitor phishing indicators in email and messaging channels that direct iOS users to interact with Chrome via specific gestures such as tap-and-hold on links.

Monitoring Recommendations

Ingest mobile device posture and browser version data into your SIEM to establish a baseline of vulnerable Chrome iOS clients.
Track user reports of address bar inconsistencies or suspicious redirects on iOS Chrome and route them to the incident response queue.
Alert on repeated failed navigation validation errors from Chrome crash and telemetry feeds where available.

How to Mitigate CVE-2026-13908

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store.
Enforce a minimum Chrome version policy in mobile device management to block or flag out-of-date installations.
Communicate the risk of tapping unfamiliar links or performing prompted gestures within Chrome on iOS to end users.

Patch Information

Google has released a fixed build in Chrome 150.0.7871.47 for iOS. Refer to the Google Chrome Update Announcement for release details. Additional context is available in the Chromium Issue Tracker Entry, which may remain restricted while affected users update.

Workarounds

Restrict browsing on iOS to trusted domains via MDM web content filters until all devices are patched.
Advise users to avoid interacting with unsolicited links and prompts inside Chrome on iOS.
Consider temporarily standardizing on an alternate, patched mobile browser for high-risk user groups until updates are deployed fleet-wide.

bash

# Example MDM compliance check for minimum Chrome iOS version
MIN_VERSION="150.0.7871.47"
INSTALLED_VERSION=$(mdm_query --app com.google.chrome.ios --field version)

if [ "$(printf '%s\n' "$MIN_VERSION" "$INSTALLED_VERSION" | sort -V | head -n1)" != "$MIN_VERSION" ]; then
  echo "Non-compliant: Chrome iOS $INSTALLED_VERSION is below $MIN_VERSION"
  mdm_action --device "$DEVICE_ID" --enforce update_required
fi