CVE-2026-13930: Google Chrome Auth Bypass Vulnerability

CVE-2026-13930 Overview

CVE-2026-13930 is an insufficient policy enforcement flaw in the Actor component of Google Chrome prior to version 150.0.7871.47. A remote attacker can bypass navigation restrictions by serving a crafted HTML page to a target user. Chromium classifies the security severity as Medium.

The weakness maps to [CWE-602: Client-Side Enforcement of Server-Side Security]. Successful exploitation requires user interaction, such as visiting an attacker-controlled page. The flaw does not permit direct code execution but allows attackers to circumvent navigation policy controls that would normally restrict where the browser can send users.

Critical Impact
Attackers can bypass Chrome navigation restrictions through a crafted HTML page, enabling redirection to unintended destinations and enabling downstream phishing or malware delivery scenarios.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers incorporating the vulnerable Actor component
Desktop stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-13930 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13930

Vulnerability Analysis

The vulnerability resides in Chrome's Actor subsystem, which handles automated navigation and interaction flows within the browser. The component fails to enforce navigation policy correctly when processing requests originating from a crafted HTML document. As a result, attackers can direct the browser to navigate to destinations that policy should have blocked.

The integrity impact is high because navigation state can be manipulated outside the user's intent. Confidentiality and availability are not directly affected. Exploitation requires the victim to load attacker-controlled content, meaning attacks depend on social engineering or compromise of a trusted site.

The EPSS score is 0.319%, reflecting a low predicted probability of exploitation in the near term. No public exploit code, CISA KEV listing, or in-the-wild abuse has been reported at the time of publication.

Root Cause

The root cause is client-side enforcement of a security decision that should be validated with stricter policy checks [CWE-602]. The Actor logic accepts navigation instructions from page context without applying the full set of restrictions that govern user-initiated navigation. This trust boundary gap allows crafted markup to steer the browser past intended constraints.

Attack Vector

Exploitation begins when a user visits an attacker-controlled or compromised page. The page includes crafted HTML that invokes the Actor navigation path in a way policy checks fail to block. The browser then follows the attacker's chosen navigation, which can be used to reach domains normally blocked, evade phishing warnings, or chain into further browser-based attacks.

The vulnerability mechanism is described in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13930

Indicators of Compromise

Chrome browser processes reporting version strings below 150.0.7871.47 in enterprise inventory data
Web proxy logs showing navigation chains that skip expected interstitial or warning pages
Unexpected redirects from trusted internal sites to external domains following HTML content loads

Detection Strategies

Inventory endpoints for Chrome installations below the patched version using software asset management tools
Correlate browser telemetry with proxy logs to identify navigation sequences that bypass URL filtering policies
Monitor referrer chains in web gateway logs for anomalous transitions consistent with policy bypass

Monitoring Recommendations

Track Chrome version distribution across the fleet and alert on hosts running builds prior to 150.0.7871.47
Enable browser telemetry forwarding to a central log store for navigation event analysis
Review secure web gateway logs for spikes in blocked-then-allowed navigation attempts

How to Mitigate CVE-2026-13930

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later across all managed endpoints
Force browser restart through enterprise policy to ensure the patched binary loads
Audit any Chromium-based applications and browsers for the same Actor component and apply upstream fixes

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Update Announcement. Administrators should deploy Chrome 150.0.7871.47 or later. Details of the underlying issue are tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce strict URL filtering at the secure web gateway to block navigation to untrusted destinations
Restrict browsing to allowlisted domains for high-risk user groups until patching completes
Deliver user awareness reminders about opening links from untrusted sources while updates are rolling out

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Force Chrome update via enterprise policy on Linux
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable