CVE-2026-13964: Google Chrome Auth Bypass Vulnerability

CVE-2026-13964 Overview

CVE-2026-13964 is a policy enforcement weakness in the WebView component of Google Chrome on Android. Versions of Chrome prior to 150.0.7871.47 fail to properly enforce navigation restrictions. A remote attacker can bypass these restrictions by serving a crafted HTML page to a vulnerable client. The flaw is categorized under CWE-284: Improper Access Control and carries a Chromium security severity rating of Medium. Exploitation requires user interaction, such as visiting an attacker-controlled page. Successful exploitation allows attackers to influence navigation flows within embedded WebView contexts, potentially redirecting users or accessing content that navigation policy should have blocked.

Critical Impact
Remote attackers can bypass WebView navigation restrictions on Android Chrome installations, enabling unauthorized navigation flows through crafted HTML content.

Affected Products

Google Chrome for Android versions prior to 150.0.7871.47
Google Android platforms hosting affected Chrome WebView builds
Applications embedding vulnerable Chrome WebView components

Discovery Timeline

2026-06-30 - CVE-2026-13964 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13964

Vulnerability Analysis

The vulnerability resides in the WebView component of Google Chrome on Android. WebView renders web content inside native Android applications and enforces navigation policies to constrain where embedded content may direct users. The affected Chrome builds do not sufficiently enforce those policies during navigation events triggered by crafted HTML. An attacker hosting a malicious page can construct HTML that circumvents the intended navigation checks. Because the attack vector is network-based and requires only that a user render the page, exploitation is straightforward against unpatched clients. The impact is limited to integrity of navigation state — confidentiality and availability are not directly affected according to the CVSS metrics.

Root Cause

The root cause is insufficient policy enforcement, mapped to CWE-284: Improper Access Control. Navigation logic within WebView accepts navigation requests that policy checks should have rejected. The enforcement gap allows crafted HTML to trigger navigation transitions that violate the containing application's intended restrictions. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker delivers a crafted HTML page — through a link, ad network, compromised site, or content loaded into an app's WebView. When the victim renders the page, embedded HTML triggers navigation transitions that bypass WebView's enforced restrictions. No authentication or elevated privileges are required.

No public proof-of-concept has been released, and no code examples are available for this issue. Refer to the Google Chrome Stable Update advisory and the linked Chromium issue tracker entry for authoritative technical detail.

Detection Methods for CVE-2026-13964

Indicators of Compromise

Chrome for Android client versions reporting a build string earlier than 150.0.7871.47
Unexpected navigation events in mobile applications embedding WebView, particularly transitions to origins outside the app's allow list
Outbound HTTP requests from mobile devices to unrecognized domains immediately following rendering of third-party HTML

Detection Strategies

Inventory managed Android devices and confirm the installed Chrome version against 150.0.7871.47 or later
Instrument in-app WebView clients with shouldOverrideUrlLoading logging to record every navigation attempt for review
Correlate mobile proxy or MDM telemetry with expected application navigation patterns to surface anomalous transitions

Monitoring Recommendations

Ingest mobile browser and MDM version telemetry into a central data lake and alert on hosts running Chrome versions below the patched build
Monitor egress network logs from Android fleets for connections to newly registered or low-reputation domains sourced from WebView user agents
Review application crash and navigation logs for repeated policy override attempts against embedded WebView surfaces

How to Mitigate CVE-2026-13964

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Force-update Chrome across managed Android devices using enterprise mobility management policies
Audit in-house Android applications that embed WebView and verify they are built against a patched Android System WebView component

Patch Information

Google addressed CVE-2026-13964 in Chrome 150.0.7871.47 on the stable channel. Deployment details are published in the Google Chrome Stable Update advisory. The underlying fix is tracked in the Chromium Issue Tracker Entry. Android System WebView must also be updated through Google Play to receive the corresponding fix for applications that embed WebView.

Workarounds

Restrict WebView-embedding applications to trusted, first-party content until devices are patched
Implement application-side allow lists in WebViewClient.shouldOverrideUrlLoading to reject unexpected navigation targets
Advise users to avoid opening untrusted links on Android devices running unpatched Chrome versions

bash

# Verify Chrome and Android System WebView versions on a managed device
adb shell dumpsys package com.android.chrome | grep versionName
adb shell dumpsys package com.google.android.webview | grep versionName