Executive brief
Google Chrome for iOS, a popular mobile web browser, contains a security vulnerability that could allow a malicious website to run unauthorized scripts. By tricking a user into performing specific touch gestures on a specially crafted webpage, an attacker could bypass security boundaries to access or modify data on other open websites. This type of attack, known as Universal Cross-Site Scripting (UXSS), can lead to the theft of sensitive information or unauthorized actions performed in the user's name.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in Google Chrome for iOS due to improper input validation of untrusted data. The flaw is triggered when a remote attacker convinces a user to interact with a malicious HTML page using specific UI gestures. This interaction allows the attacker to bypass the Same-Origin Policy (SOP) and inject arbitrary HTML or JavaScript into the context of other websites. The vulnerability is tracked as CVE-2026-13812 and was addressed in version 150.0.7871.47. The root cause is categorized under CWE-20 (Improper Input Validation).
Affected products
- Google Chrome for iOS prior to 150.0.7871.47
Timeline
- 2026-04-30: disclosed: Reported to Chromium by Google researchers.
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47.
- 2026-06-30: advisory