CVE-2026-13946: Google Chrome XSS Vulnerability

CVE-2026-13946 Overview

CVE-2026-13946 is a cross-origin data leak vulnerability in the ScriptInjections component of Google Chrome on iOS. The flaw affects Chrome versions prior to 150.0.7871.47 and stems from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Google classifies this issue with Chromium security severity Medium and it is categorized under [CWE-352] Cross-Site Request Forgery. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page. The vulnerability impacts confidentiality of data across origin boundaries but does not affect integrity or availability.

Critical Impact
A remote attacker can bypass the same-origin policy on iOS Chrome to read cross-origin data through a crafted HTML page, exposing information from other web origins the victim is authenticated to.

Affected Products

Google Chrome on iOS prior to 150.0.7871.47
Apple iPhone OS (as the host platform)
Chromium-based script injection subsystem on iOS

Discovery Timeline

2026-06-30 - CVE-2026-13946 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13946

Vulnerability Analysis

The vulnerability resides in the ScriptInjections component of Google Chrome on iOS. Script injection routines are responsible for evaluating JavaScript in the context of web pages, and they must strictly enforce origin isolation. In affected builds, this component does not correctly honor origin boundaries when handling injected scripts triggered by a crafted HTML page. An attacker leverages this gap to observe or exfiltrate data belonging to a different web origin loaded in the same browser session.

The issue is tracked as [CWE-352] Cross-Site Request Forgery, reflecting the cross-origin nature of the leak. The attack requires user interaction such as clicking a link or visiting an attacker-controlled page. The EPSS probability of exploitation stands at 0.146%, indicating limited observed exploitation activity at disclosure. Details of the underlying defect are restricted in the Chromium Issue Tracker Entry until a majority of users receive the fix.

Root Cause

The root cause is an inappropriate implementation in how the iOS-specific Chrome build performs script injection into web content. Origin checks around injected script execution are insufficient, allowing script context or resulting data to cross origin boundaries. Because Chrome on iOS uses WKWebView under Apple's platform constraints, the injection path differs from desktop Chrome and introduces this platform-specific weakness.

Attack Vector

Exploitation is remote over the network and requires user interaction. The attacker hosts a crafted HTML page and lures a victim using iOS Chrome to visit it. Once loaded, the malicious page triggers the flawed script injection flow to read data from another origin the victim is authenticated to, such as an email or banking session. No privileges are required on the target device, and no local access is needed.

No public proof-of-concept or exploit code is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-13946

Indicators of Compromise

Outbound HTTP requests from iOS Chrome to attacker-controlled domains immediately after visiting suspicious links.
Anomalous cross-origin request patterns in web application logs, such as unexpected read requests originating from third-party referrers.
iOS Chrome telemetry showing versions older than 150.0.7871.47 in the mobile device inventory.

Detection Strategies

Inventory mobile browser versions and flag any iOS Chrome installation below 150.0.7871.47 as vulnerable.
Inspect web server logs for suspicious cross-origin fetches with mobile Chrome iOS user-agent strings.
Correlate mobile web proxy logs with threat intelligence feeds to identify visits to crafted HTML lure pages.

Monitoring Recommendations

Enable enterprise mobility management (EMM) reporting on installed Chrome versions across managed iOS fleets.
Monitor content security policy (CSP) violation reports for cross-origin script activity on sensitive web applications.
Track browser update compliance and alert when devices remain on vulnerable versions beyond a defined patch SLA.

How to Mitigate CVE-2026-13946

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store.
Push the update through mobile device management (MDM) to all managed iOS devices.
Advise users to avoid clicking untrusted links in email, messaging apps, or social media until updates complete.

Patch Information

Google addressed the vulnerability in Chrome for iOS 150.0.7871.47. Full details are available in the Google Chrome Desktop Update release note and the Chromium Issue Tracker Entry. Deploy the update through the Apple App Store or through your organization's managed app distribution mechanism.

Workarounds

Use an alternative browser on iOS such as Safari for sensitive workflows until Chrome is updated.
Restrict access to sensitive web applications from mobile browsers running vulnerable Chrome versions using conditional access policies.
Enforce strict CSP and SameSite=Strict cookie attributes on internal web applications to reduce cross-origin data exposure.

bash

# Verify Chrome for iOS version compliance via MDM query (example)
# Query installed app version and compare against fixed release
mdm-cli devices query --app "com.google.chrome.ios" --field version \
  | awk '$2 < "150.0.7871.47" {print $1" NEEDS UPDATE"}'