CVE-2026-13917: Google Chrome Auth Bypass Vulnerability

CVE-2026-13917 Overview

CVE-2026-13917 is an input validation vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. The flaw allows a remote attacker to bypass navigation restrictions when a user is convinced to perform specific user interface gestures on a crafted HTML page. Google classifies the Chromium security severity as Medium. The weakness is tracked under CWE-20: Improper Input Validation and requires user interaction to succeed.

Critical Impact
Attackers can bypass Chrome for iOS navigation restrictions through crafted HTML content, enabling redirection or spoofing attacks against users who interact with malicious pages.

Affected Products

Google Chrome for iOS versions prior to 150.0.7871.47
Apple iOS devices running vulnerable Chrome builds
Any iOS environment where Chrome is used as the browser

Discovery Timeline

2026-06-30 - CVE-2026-13917 published to the National Vulnerability Database
2026-07-01 - Last updated in the NVD database

Technical Details for CVE-2026-13917

Vulnerability Analysis

CVE-2026-13917 stems from insufficient validation of untrusted input in Chrome for iOS. The browser fails to properly validate navigation requests originating from crafted HTML content. When a user performs specific UI gestures on a malicious page, the browser processes the input without enforcing navigation restrictions that would normally block the transition.

The result is a navigation bypass that can be leveraged for URL spoofing, redirection to attacker-controlled content, or evasion of security prompts. The flaw does not enable code execution or data disclosure directly. Its integrity impact reflects the ability to manipulate what the user sees and where the browser navigates. See the Chromium Issue Tracker entry for the underlying report.

Root Cause

The root cause is improper input validation ([CWE-20]) in the navigation handling logic of Chrome for iOS. The browser accepts and acts upon gesture-driven navigation events from untrusted HTML pages without confirming that the requested navigation conforms to Chrome's iOS security policies.

Attack Vector

Exploitation requires network delivery of a crafted HTML page and user interaction. An attacker hosts a malicious page and lures the victim into loading it and performing a specific UI gesture such as a tap, long press, or swipe. The gesture triggers the flawed navigation path, allowing the attacker to bypass restrictions. No authentication or elevated privileges are required.

No public proof-of-concept or exploit code has been released. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.242%.

Detection Methods for CVE-2026-13917

Indicators of Compromise

Chrome for iOS versions below 150.0.7871.47 present in mobile device inventory
Unexpected redirects or navigation to unfamiliar domains following user interaction with external HTML content
Mobile telemetry showing outbound connections to suspicious URLs immediately after opening links from messaging or email applications

Detection Strategies

Query mobile device management (MDM) inventory to enumerate iOS devices running Chrome versions prior to 150.0.7871.47
Correlate web proxy logs with mobile user-agent strings identifying vulnerable Chrome for iOS builds
Review threat intelligence feeds for domains hosting crafted HTML pages targeting Chrome navigation flaws

Monitoring Recommendations

Enable mobile threat defense logging to capture browser navigation events and URL access patterns
Track Chrome for iOS version distribution across the fleet through MDM reporting
Monitor phishing and smishing campaigns that direct users to interactive HTML content

How to Mitigate CVE-2026-13917

Immediate Actions Required

Update Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store
Push the update through MDM policies where centrally managed
Notify users to avoid tapping or interacting with unsolicited links until patched

Patch Information

Google released the fix in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Stable Channel Update. The Chromium Issue Tracker entry references the underlying bug. Verify installed versions through chrome://version or through MDM inventory reports.

Workarounds

Switch to an alternative up-to-date browser on iOS until the Chrome update is applied
Restrict opening untrusted links in Chrome and use in-app browsers with stricter navigation controls where available
Apply MDM policies that enforce automatic App Store updates for managed applications

bash

# Verify Chrome for iOS version via MDM query (Jamf example)
/usr/local/bin/jamf recon -endUsername "$USER"
# Confirm installed CFBundleShortVersionString for com.google.chrome.ios is >= 150.0.7871.47