# CVE-2026-13924: Google Chrome WebView Same Origin Policy bypass

Source: https://junglewise.ai/threats/cve-2026-13924-google-chrome-webview-same-origin-policy-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-13924 · Severity: info · CVSS 4.3 · Published 2026-06-30

A security issue in Google Chrome on Android could allow a malicious website to bypass standard security boundaries. This component, known as WebView, is used by many Android apps to display web content. If exploited, an attacker could potentially access data from other websites or interfere with the user's browsing session, though this requires the attacker to have already partially compromised the browser's internal processing.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-13924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13924 being exploited in the wild.

**How severe is CVE-2026-13924?** Informational severity, with a CVSS score of 4.3, published 30 June 2026.

**Which products and versions are affected?** Google Chrome prior to 150.0.7871.47.

**Is there a fix for CVE-2026-13924?** A patch was published on 2026-06-30: Fixed in version 150.0.7871.47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13924 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13924?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the WebView component of Google Chrome for Android. The flaw allows a remote attacker to bypass the Same Origin Policy (SOP), which is the fundamental security mechanism that prevents websites from attacking each other. To successfully exploit this, an attacker must first compromise the renderer process. Once achieved, they can use a specially crafted HTML page to access data across origins. The vulnerability is addressed in version 150.0.7871.47.

## Affected products

- Google Chrome for Android prior to 150.0.7871.47

## Timeline

- 2026-06-30: disclosed
- 2026-06-30: patched: Fixed in version 150.0.7871.47

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html)
- [https://issues.chromium.org/issues/511784747](https://issues.chromium.org/issues/511784747)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)