CVE-2026-13843: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150

Synopsis

This is an insufficient input validation vulnerability in Google Chrome for iOS, affecting all versions prior to 150.0.7871.47. A remote attacker who has already compromised the Chrome renderer process can exploit this flaw over the network by luring a victim to a crafted HTML page, with no authentication required. Successful exploitation enables a sandbox escape, granting the attacker capabilities beyond the renderer's restricted environment, including full access to confidential data, the ability to tamper with data, and disruption of service. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, as the exploit is delivered via a remote crafted HTML page.

• AuthenticationNot required

  No authentication or account credentials are needed; the attacker operates entirely as an unauthenticated remote party.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, requiring at least minimal social engineering.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond a prior renderer compromise.

Blast Radius

• A successful sandbox escape lets the attacker read arbitrary data stored in or accessible to the Chrome process on the device, including session tokens, cookies, and cached credentials.
• The attacker gains the ability to write or modify data outside the renderer sandbox, including files and application state the compromised process would not normally touch.
• The attacker can crash or destabilize the browser and any dependent services on the affected iOS device, causing denial of service.
• Because the CVSS scope is changed (S:C), impact extends beyond the Chrome sandbox itself to other components on the host system.