CVE-2026-8013: Google Chrome FedCM Data Leak Vulnerability

CVE-2026-8013 Overview

CVE-2026-8013 is an input validation vulnerability in the Federated Credential Management (FedCM) component of Google Chrome. Versions of Chrome prior to 148.0.7778.96 fail to properly validate untrusted input passed to FedCM. A remote attacker can exploit this flaw by serving a crafted HTML page that, when visited, leaks cross-origin data to the attacker. The issue is classified under [CWE-20] Improper Input Validation. Chromium classifies this as a low severity issue, while NVD assigns it a medium rating based on its network attack vector and confidentiality impact.

Critical Impact
A crafted web page can leak limited cross-origin data from a victim's browser session, breaking the same-origin guarantees that protect federated identity flows.

Affected Products

Google Chrome desktop versions prior to 148.0.7778.96
Chromium-based browsers that integrate the affected FedCM implementation
Operating systems running vulnerable Chrome builds (Windows, macOS, Linux)

Discovery Timeline

2026-05-06 - CVE-2026-8013 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-8013

Vulnerability Analysis

FedCM is the browser API that mediates federated sign-in flows between identity providers and relying parties. The API exposes an interface for requesting and exchanging identity credentials across origins. CVE-2026-8013 stems from insufficient validation of input received during these cross-origin exchanges.

When a victim loads an attacker-controlled HTML page, the page can invoke FedCM in a way that triggers the unvalidated input path. The browser then handles the malformed input in a manner that exposes data belonging to a different origin. Exploitation requires user interaction, reflected in the CVSS user interaction requirement, but does not require authentication or elevated privileges. The impact is limited to confidentiality, with no integrity or availability effects reported.

Root Cause

The root cause is improper validation of untrusted input within the FedCM implementation. The component accepts data from a remote origin and processes it without enforcing the constraints required to maintain origin isolation. This deviation from the expected validation contract allows information that should remain partitioned by origin to cross the boundary.

Attack Vector

The vector is network-based and entirely browser-resident. An attacker hosts a malicious HTML page and lures the victim into visiting it. The page issues crafted FedCM-related requests that exploit the missing validation. No prior credentials, local access, or man-in-the-middle position are required. The attacker recovers cross-origin data observable through the FedCM response path.

No verified proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for technical details once the underlying bug report becomes public.

Detection Methods for CVE-2026-8013

Indicators of Compromise

Browser telemetry showing Chrome client versions earlier than 148.0.7778.96 actively browsing the web
Outbound connections from end-user hosts to unfamiliar domains immediately followed by FedCM-related script execution
Unexpected federated identity prompts or credential dialogs originating from low-reputation sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 148.0.7778.96
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains serving HTML that invokes FedCM APIs
Correlate browser process telemetry with network egress to identify anomalous cross-origin identity flows

Monitoring Recommendations

Enable browser management policies that report Chrome version and update status to a central console
Ingest endpoint and proxy logs into a SIEM and alert on Chrome user-agent strings reporting outdated builds
Track patch deployment progress against the vendor advisory until all hosts run a fixed version

How to Mitigate CVE-2026-8013

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all desktop platforms
Force a browser restart after deployment to ensure the patched binary is loaded
Audit Chromium-derived browsers in the environment and apply vendor updates that incorporate the FedCM fix
Remind users to avoid interacting with unsolicited federated sign-in prompts on untrusted pages

Patch Information

Google released the fix in the Chrome Stable channel update referenced in the Google Blog Update. Administrators should validate that managed Chrome installations have advanced to 148.0.7778.96 or higher. Enterprise deployments using Chrome Browser Cloud Management or Group Policy should confirm that auto-update is enabled and not blocked by network restrictions.

Workarounds

Restrict access to untrusted external sites via web filtering until patching completes
Disable or restrict FedCM through enterprise browser policies where federated identity flows are not required
Use browser isolation for high-risk browsing on hosts that cannot be patched immediately

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Example Group Policy check on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv