CVE-2026-13892

MediumCVSS 6.5

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile — higher than 20% of all known CVEs

Summary

Inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker, by convincing a user to perform specific UI gestures, to leak cross-origin data via a crafted HTML page.

Risk Assessment

The risk involves potential theft of confidential data across different origins (cross-origin), which could lead to user privacy breaches and leakage of sensitive information.

Recommendation

Immediately update Google Chrome on iOS to version 150.0.7871.47 or later to remediate the vulnerability.

Original NVD description (English source)

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)