What is the CVSS score of CVE-2026-13862?

CVE-2026-13862 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13862?

Yes, a patch is available for CVE-2026-13862. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-13862

EUVD-2026-40548 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-2m65-xxr3-mhcv

Information Disclosure Google Apple Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Privileged network position prerequisite warrants AC:H, not AC:L; no authentication required (PR:N); only confidentiality impacted.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:56 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.

Technical ContextAI

The vulnerability resides in Google Chrome's implementation of the Web Authentication API (WebAuthn), which governs Passkeys and FIDO2 hardware security keys. CWE-693 (Protection Mechanism Failure) indicates the browser's cross-origin isolation enforcement - a core browser security primitive - is insufficiently applied within the WebAuthn flow on iOS. The iOS platform introduces a distinct code path compared to desktop Chrome, likely due to platform-specific WebKit/iOS API bridging, which is where the policy gap manifests. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions on iOS before the fix. The cross-origin data leak means that data belonging to one web origin (e.g., a banking site) could be read by a crafted page under attacker control through this WebAuthn policy enforcement gap.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later; this is the vendor-released patch confirmed by the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. iOS users should apply the update via the App Store. For environments where immediate patching is not possible, a targeted compensating control is to restrict access to untrusted or public Wi-Fi networks where a privileged network position could be obtained by an attacker, since the attack requires network interception. Enforcing Mobile Device Management (MDM) policies that mandate minimum Chrome version compliance will reduce exposure across managed fleets. Disabling Passkeys or security key authentication in enterprise SSO configurations is a more disruptive workaround and is not recommended unless network controls cannot be enforced, as it degrades authentication security.