CVE-2026-13924 Overview
CVE-2026-13924 is a same-origin policy bypass in the WebView component of Google Chrome on Android. The flaw stems from insufficient validation of untrusted input [CWE-20] and affects Chrome for Android versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can use a crafted HTML page to cross origin boundaries and access data from unrelated origins. Google's Chromium team rated the security severity as Medium.
Critical Impact
A compromised renderer can read cross-origin content by defeating the same-origin policy through a crafted HTML page delivered to Chrome WebView on Android.
Affected Products
- Google Chrome on Android prior to 150.0.7871.47
- Google Android (WebView component)
- Applications embedding Chrome WebView on Android
Discovery Timeline
- 2026-06-30 - CVE-2026-13924 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13924
Vulnerability Analysis
The vulnerability lives in Chrome's Android WebView, the component that renders web content inside Chrome and other Android applications. WebView failed to sufficiently validate untrusted input crossing a trust boundary, which allowed an attacker to defeat the same-origin policy (SOP). The same-origin policy is the browser's core isolation primitive that prevents content from one origin from reading data belonging to another.
Exploitation is not straightforward. The attacker must already control the renderer process, typically through a separate memory corruption or logic bug. Once that foothold exists, a crafted HTML page can leverage the input validation gap to read content that should remain confined to another origin. The impact is scoped to integrity of the browser security model, with confidentiality and availability of the underlying device largely unaffected.
Root Cause
The root cause is improper input validation [CWE-20] in WebView's handling of data received from a compromised renderer. Trust decisions were made on inputs that a hostile renderer could shape, letting the attacker present a document context that WebView treated as legitimate when enforcing origin checks.
Attack Vector
The attack requires network delivery of a crafted HTML page and user interaction to load that content in a vulnerable WebView. The attacker also needs prior renderer process compromise, meaning this CVE is typically chained with a separate renderer exploit. Successful chaining lets attackers exfiltrate cross-origin data such as session tokens, cookies exposed to script, or sensitive DOM content.
No verified public proof-of-concept code exists for CVE-2026-13924. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor references.
Detection Methods for CVE-2026-13924
Indicators of Compromise
- Chrome for Android reporting a version string below 150.0.7871.47 in chrome://version or MDM inventory.
- Unexpected cross-origin resource reads originating from WebView-hosted applications in network telemetry.
- Renderer process crashes on Android devices preceding anomalous outbound HTTPS traffic to attacker-controlled hosts.
Detection Strategies
- Inventory managed Android fleets for Chrome and Android System WebView package versions and flag installations below 150.0.7871.47.
- Correlate mobile browser crash telemetry with subsequent data exfiltration attempts to catch renderer exploit chaining.
- Hunt for HTML content served over the network that abuses WebView JavaScript bridges or unusual postMessage patterns.
Monitoring Recommendations
- Enable Google Play Protect and monitor Android System WebView update compliance across managed devices.
- Alert on Android applications embedding WebView that connect to newly registered or low-reputation domains.
- Track EPSS scoring for this CVE, currently 0.319%, and re-evaluate priority if public exploit code emerges.
How to Mitigate CVE-2026-13924
Immediate Actions Required
- Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store.
- Force-update the Android System WebView package on all managed devices via MDM policy.
- Restrict installation of untrusted Android applications that embed WebView with permissive JavaScript bridges.
Patch Information
Google released the fix in Chrome for Android 150.0.7871.47. Details are available in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry. Updating Chrome and Android System WebView together closes the vulnerable code path.
Workarounds
- Avoid opening untrusted links inside Chrome for Android or WebView-hosted applications until patched.
- Disable or restrict WebView-based apps that render arbitrary third-party HTML content in enterprise fleets.
- Enforce Chrome Enterprise policies that block navigation to uncategorized or high-risk domains on mobile devices.
# Verify Chrome for Android version on a managed device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Verify Android System WebView version
adb shell dumpsys package com.google.android.webview | grep versionName
# Expected output: versionName=150.0.7871.47 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
