CVE-2026-13913: Chrome iOS Information Disclosure Flaw

CVE-2026-13913 Overview

CVE-2026-13913 is an insufficient policy enforcement vulnerability in the Autofill component of Google Chrome on iOS. Versions prior to 150.0.7871.47 fail to properly enforce origin-based policy checks. A remote attacker who convinces a user to perform specific UI gestures can leak cross-origin data through a crafted HTML page. The issue is classified under CWE-346: Origin Validation Error and rated Medium by the Chromium security team.

Critical Impact
Successful exploitation permits cross-origin data disclosure through Autofill, exposing sensitive user information such as saved form data to attacker-controlled origins.

Affected Products

Google Chrome on iOS versions prior to 150.0.7871.47
Chrome iOS Autofill component
iOS devices running vulnerable Chrome builds

Discovery Timeline

2026-06-30 - CVE-2026-13913 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13913

Vulnerability Analysis

The vulnerability resides in Chrome iOS Autofill, which fills form fields with saved user data such as addresses, payment details, and other profile information. Insufficient policy enforcement means Autofill does not correctly validate the origin context before populating field values. An attacker hosts a crafted HTML page containing form elements designed to trigger Autofill behavior. When the victim performs the required UI gesture, Autofill discloses data associated with a different origin than the one visually presented to the user.

The attack requires user interaction, which limits automated mass exploitation. However, social engineering can reliably induce the necessary gesture through phishing lures or deceptive site layouts. The confidentiality impact is high because leaked data may include saved credentials, addresses, or payment fields.

Root Cause

The root cause is an origin validation error [CWE-346] in the Autofill policy enforcement logic on iOS. Chrome fails to consistently bind autofilled values to the origin that originally stored them. This allows cross-origin form elements on a malicious page to receive data intended for a legitimate origin.

Attack Vector

The attack is network-based and does not require privileges or credentials. The attacker delivers a crafted HTML page through phishing, malvertising, or a compromised site. The victim must interact with the page, such as tapping a specific form field or button. Once the gesture triggers Autofill, cross-origin data is written into attacker-controlled fields and exfiltrated. No verified proof-of-concept code has been published. See the Chromium Issue Tracker #508260619 for advisory context.

Detection Methods for CVE-2026-13913

Indicators of Compromise

Chrome iOS clients running versions earlier than 150.0.7871.47 present on managed mobile inventories.
Outbound web traffic to unfamiliar domains hosting HTML pages with hidden or overlaid form fields designed to capture Autofill data.
User reports of unexpected form population, unfamiliar prompts, or UI gestures preceding suspected credential loss.

Detection Strategies

Inventory Chrome iOS versions across mobile device management (MDM) telemetry and flag builds below 150.0.7871.47.
Monitor web proxy and DNS logs for HTTP responses containing suspicious form structures paired with cross-origin scripts.
Correlate phishing email delivery events with subsequent mobile browser navigation to newly registered or low-reputation domains.

Monitoring Recommendations

Enable browser telemetry forwarding to a centralized data lake for continuous version and configuration visibility.
Alert on account activity anomalies, such as new-location logins, that could indicate leaked credentials from Autofill fields.
Track user-reported phishing submissions referencing mobile Chrome interactions and correlate with browser version data.

How to Mitigate CVE-2026-13913

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store.
Push forced Chrome updates via MDM policies for managed iOS fleets.
Communicate phishing awareness guidance emphasizing caution with unexpected form prompts and UI gestures.

Patch Information

Google addressed CVE-2026-13913 in Chrome iOS 150.0.7871.47. Refer to the Google Chrome Desktop Update advisory and the Chromium Issue Tracker #508260619 for release details. Applying the patched version fully remediates the origin validation error.

Workarounds

Disable Autofill for addresses, payment methods, and passwords in Chrome iOS Settings until patched builds are deployed.
Restrict use of Chrome iOS for sensitive workflows and route users to a patched or alternative browser during the remediation window.
Educate users to avoid interacting with unsolicited forms delivered through email links or unfamiliar sites.

bash

# Example: MDM configuration snippet to enforce Chrome iOS Autofill disablement
# Apply via Apple Configuration Profile or MDM managed app configuration
<key>AutofillAddressEnabled</key>
<false/>
<key>AutofillCreditCardEnabled</key>
<false/>
<key>PasswordManagerEnabled</key>
<false/>