CVE-2026-13843: Google Chrome for iOS Insufficient Input Validation Leading to Possible Sandbox Escape
Google Chrome on iOS builds prior to 150.0.7871.47 contain an improper input validation flaw (CWE-20). According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The CNA rates it critical with a CVSS 3.1 score of 9.6, and the record shows no KEV listing; updating to 150.0.7871.47 or later is the main remediation step.
Overview
CVE-2026-13843 affects Chrome for iOS (Google Chrome on iOS). The CNA classifies it as improper input validation (CWE-20). The published description states that insufficient validation of untrusted input could let a remote attacker who had already compromised the renderer process potentially escape the sandbox through a crafted HTML page.
Impact
- The CNA-provided CVSS 3.1 base score is 9.6, rated critical.
- The record describes the potential outcome as a sandbox escape, which is a step beyond an already compromised renderer process.
- The vector in the record reports high confidentiality, integrity and availability impact, a scope change, and user interaction required.
- The record does not describe the consequences of a successful escape beyond the sandbox boundary.
Affected products and versions
- Google Chrome on iOS prior to 150.0.7871.47, as listed in the record (range shown as less than 150.0.7871.47).
- The record contains no fixed-version field. The affected range implies that 150.0.7871.47 and later are not affected, but this is an inference from the stated range.
Exploitation status
- The record shows that this CVE is not listed in the CISA KEV catalog.
- The EPSS probability is 0.00345 with a percentile of 0.26185 in the data provided.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Update Chrome for iOS to 150.0.7871.47 or later, following the vendor release notes linked in the record: Chrome Releases stable channel update.
- Use the managed device inventory to confirm which iOS devices run Chrome builds below the fixed threshold.
- Restrict browsing of untrusted or unknown web content on managed devices until updates are applied, as a general risk-reduction measure.
Detection guidance
- Review mobile device management or asset inventory data for the installed Chrome version on iOS devices.
- Monitor for unexpected browser crashes or renderer instability reported by endpoint or mobile security tooling, treating them as signals for further review rather than confirmed compromise.
- Track vendor advisories for any updates to the record's status.
Limitations of the available information
- The record has no title, so the title in this analysis is derived from the description.
- No fixed-version field is provided in the record; the fixed build is taken from the affected range and the vendor release notes.
- The Chromium issue tracker entry is marked as requiring permissions, so its technical details were not available for review.
- No public proof-of-concept or technical exploit details are included in the sources consulted, and none are reproduced here.
- The EPSS data date is later than the publication date, so the EPSS values should be treated as a snapshot.
Frequently asked questions
Which Chrome for iOS versions are affected by CVE-2026-13843?
The record lists Google Chrome on iOS prior to 150.0.7871.47 as affected. Builds at or above that version are not described as affected by the record.
Is CVE-2026-13843 known to be actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Confirm the Chrome version on iOS devices and update to 150.0.7871.47 or later, using the vendor release notes referenced in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.