CVE-2026-13953: Google Chrome Auth Bypass Vulnerability

CVE-2026-13953 Overview

CVE-2026-13953 is a medium-severity flaw in the SplitView component of Google Chrome versions prior to 150.0.7871.47. The vulnerability stems from an inappropriate implementation classified under [CWE-284] Improper Access Control. A remote attacker who has already compromised the renderer process can bypass Chrome's navigation restrictions by serving a crafted HTML page. Successful exploitation lets the attacker navigate the browser to locations that Chrome's security model would normally forbid, weakening origin isolation guarantees within the browser.

Critical Impact
An attacker with a compromised renderer can bypass navigation restrictions in SplitView, undermining browser sandbox boundaries and enabling further attack chains against user data and browsing context integrity.

Affected Products

Google Chrome versions prior to 150.0.7871.47 (Desktop, Stable channel)
Chromium-based browsers that inherit the SplitView implementation from upstream Chromium
Enterprise Chrome deployments not updated to the current stable release

Discovery Timeline

2026-06-30 - CVE-2026-13953 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13953

Vulnerability Analysis

The flaw resides in Chrome's SplitView feature, which allows the browser to display two web contents side by side within the same window. SplitView must enforce navigation restrictions so that content in one pane cannot manipulate navigation of the other pane in ways that break origin or context boundaries.

The implementation fails to consistently validate navigation requests originating from a compromised renderer. As a result, an attacker who has already achieved code execution inside the renderer sandbox can influence navigation flows that should be restricted. Exploitation requires user interaction, since the target must load the crafted HTML page in a SplitView session. The impact is limited to integrity of the navigation state and browsing context. Confidentiality and availability are not directly affected by this issue in isolation.

Root Cause

The root cause is improper access control within the SplitView navigation logic. Chrome does not adequately restrict which navigation transitions a renderer process may trigger when SplitView is active. Because renderers are treated as untrusted in Chrome's threat model, any renderer-driven action must pass browser-process validation. That validation is incomplete for SplitView navigation paths, allowing crafted inputs to bypass the intended restrictions.

Attack Vector

Exploitation requires a chained scenario. The attacker must first compromise Chrome's renderer process, typically through a separate memory corruption or type confusion vulnerability. With renderer control established, the attacker delivers a crafted HTML page that abuses the SplitView navigation path. The user must interact with the malicious content within SplitView for the bypass to succeed. No elevated privileges are needed on the host system.

No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker Entry for technical background once access restrictions are lifted.

Detection Methods for CVE-2026-13953

Indicators of Compromise

Chrome browser processes at versions below 150.0.7871.47 observed loading untrusted HTML content in SplitView sessions
Unexpected cross-origin navigation events originating from renderer processes with anomalous parent-child relationships
Outbound connections from Chrome to attacker-controlled domains immediately following SplitView interaction

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 150.0.7871.47
Correlate browser telemetry with process creation events to identify renderer processes performing unusual navigation patterns
Monitor for exploitation chains where a renderer compromise precursor vulnerability is followed by anomalous browser behavior

Monitoring Recommendations

Ingest Chrome update and version telemetry into your SIEM or data lake for continuous version-drift monitoring
Alert on browser processes making network requests to newly registered or low-reputation domains after user interaction with SplitView
Track Chrome crash reports and renderer termination events, which often precede or follow chained exploitation attempts

How to Mitigate CVE-2026-13953

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints without delay
Force-restart Chrome after deployment so the patched binary is loaded into memory
Audit Chromium-based third-party browsers in the environment and apply corresponding upstream updates

Patch Information

Google addressed this issue in the Stable channel release documented in the Google Chrome Update Announcement. Administrators should validate that automatic updates are enabled through Chrome Enterprise policies and confirm rollout via version reporting. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Disable or restrict use of the SplitView feature through enterprise policy until patching is complete
Enforce site isolation and strict same-origin policies via Chrome Enterprise configuration to reduce renderer compromise impact
Limit user browsing to trusted sites through URL allowlisting where feasible until endpoints are updated

bash

# Verify installed Chrome version meets the fixed build on Linux/macOS
google-chrome --version | awk '{print $3}' | \
  awk -F. '{ if ($1 < 150 || ($1==150 && $2==0 && $3<7871) || ($1==150 && $2==0 && $3==7871 && $4<47)) print "VULNERABLE"; else print "PATCHED" }'

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv