CVE-2026-13929: Google Chrome Auth Bypass Vulnerability

CVE-2026-13929 Overview

CVE-2026-13929 is an input validation vulnerability [CWE-20] in the DevTools component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to enforce navigation policies correctly. A local attacker can bypass navigation restrictions by delivering a malicious file to the target device. Google classifies the Chromium security severity as Medium.

The flaw requires local access and user interaction, limiting mass exploitation. However, successful abuse allows an attacker to redirect DevTools to attacker-controlled destinations. This can lead to integrity impact on the browsing session on Android devices.

Critical Impact
Local attackers with a malicious file can bypass DevTools navigation restrictions on Chrome for Android, enabling integrity-impacting redirection and policy circumvention within the browser.

Affected Products

Google Chrome for Android versions prior to 150.0.7871.47
Google Android devices running vulnerable Chrome builds
Chromium-based DevTools component on Android

Discovery Timeline

2026-06-30 - CVE-2026-13929 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13929

Vulnerability Analysis

The vulnerability resides in the DevTools component shipped with Google Chrome on Android. DevTools enforces navigation policies that restrict where inspector frames and file-backed contexts can navigate. The affected builds do not adequately validate navigation requests originating from local file input. An attacker who convinces a user to open a crafted file within DevTools can trigger navigation outside the intended policy boundary.

The issue is categorized as improper input validation [CWE-20]. Chromium tracks the root cause as insufficient enforcement rather than a missing check on the surface. The impact vector emphasizes integrity, because the attacker can influence the destination and content rendered inside privileged DevTools contexts without directly disclosing data or crashing the process.

Root Cause

DevTools on Android accepts navigation directives derived from a locally supplied file without verifying that the target complies with policy constraints. This gap allows a crafted file to steer DevTools navigation to a location the policy should reject. The Chromium fix landed in Chrome 150.0.7871.47, tightening enforcement in the DevTools navigation path.

Attack Vector

Exploitation requires local delivery of a malicious file and user interaction to open it in a context that reaches DevTools. Remote-only attacks are not viable because the attack vector is local. Once triggered, the malicious file causes DevTools to perform a navigation the policy should have blocked, enabling further staged actions inside the browser.

No public proof-of-concept exploit is listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. Refer to the Chromium Issue Tracker Entry for developer-facing detail once access restrictions are lifted.

Detection Methods for CVE-2026-13929

Indicators of Compromise

Chrome for Android builds reporting version strings below 150.0.7871.47 in enterprise inventory feeds.
Unexpected DevTools sessions launched shortly after a file open event on managed Android devices.
Navigation events from devtools:// or file:// origins to unexpected external destinations recorded in browser telemetry.

Detection Strategies

Inventory Chrome for Android versions across managed devices and flag any host below the fixed build.
Correlate file-open activity on mobile endpoints with subsequent Chrome navigation to untrusted domains.
Review mobile browser policy logs for DevTools activity on production user profiles, which is uncommon in enterprise fleets.

Monitoring Recommendations

Ingest Chrome Enterprise reporting and Android MDM telemetry into a central analytics platform to track browser versions.
Alert on installation or sideloading of files with extensions commonly used to trigger DevTools navigation flows.
Track outbound network connections initiated by Chrome on Android to newly registered or low-reputation domains.

How to Mitigate CVE-2026-13929

Immediate Actions Required

Update Google Chrome for Android to version 150.0.7871.47 or later through the Google Play Store or managed configuration.
Enforce automatic updates for Chrome on all managed Android devices via mobile device management (MDM) policy.
Restrict DevTools availability on managed user profiles where mobile debugging is not required for business use.

Patch Information

Google fixed the issue in Chrome 150.0.7871.47. Details of the stable channel release are available in the Google Chrome Desktop Update advisory, with the corresponding Chromium change referenced in the Chromium Issue Tracker Entry.

Workarounds

Block users from opening untrusted files on Android devices by enforcing file-source restrictions through MDM.
Disable Chrome DevTools on managed profiles using the DeveloperToolsAvailability enterprise policy where feasible.
Educate users to avoid opening unsolicited files that request handling by the Chrome browser on Android.

bash

# Configuration example: enforce Chrome policy on Android via MDM managed configuration
# Set DeveloperToolsAvailability to 2 (Disallowed) for standard users
{
  "DeveloperToolsAvailability": 2,
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true
}