Description
Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Side‑channel information leakage exists in WebAuthentication in Google Chrome on iOS before version 150.0.7871.47. A crafted HTML page can trigger the browser to unintentionally expose data that originates from a different origin. The primary impact is unauthorized disclosure of information from the victim device, reflecting a CWE‑20 input validation weakness.

Affected Systems

Google Chrome on iOS, versions prior to 150.0.7871.47 contain the vulnerability; later releases include the fix.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV, so exploitation likelihood is very low. The attack vector is presumed remote, via a malicious web page that the user visits, after which the flaw allows cross‑origin data exfiltration.

Generated by OpenCVE AI on July 16, 2026 at 00:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on iOS to version 150.0.7871.47 or newer
  • If a patch is not yet available, block or disable the WebAuthentication API
  • Monitor user authentication activity and maintain general security hygiene such as keeping browsers up to date

Generated by OpenCVE AI on July 16, 2026 at 00:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Thu, 16 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
Title Information Leakage via WebAuthentication Side-Channel in Chrome on iOS

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leakage via WebAuthentication in Chrome for iOS

Sun, 12 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leakage via WebAuthentication in Chrome for iOS

Sat, 11 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Cross‑origin data leakage via WebAuthentication in Chrome on iOS

Fri, 10 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Cross‑origin data leakage via WebAuthentication in Chrome on iOS

Tue, 07 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAuthentication Side‑Channel in Chrome iOS

Mon, 06 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAuthentication Side‑Channel in Chrome iOS

Mon, 06 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage through WebAuthentication in Chrome on iOS

Sun, 05 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage through WebAuthentication in Chrome on iOS

Sun, 05 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Side-Channel Information Leakage via WebAuthentication on iOS

Sat, 04 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Side-Channel Information Leakage via WebAuthentication on iOS

Fri, 03 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Chrome WebAuthentication Side-Channel Leak on iOS

Thu, 02 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title Chrome WebAuthentication Side-Channel Leak on iOS

Thu, 02 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Side-Channel Leakage of Cross-Origin Data via WebAuthentication in Chrome on iOS

Thu, 02 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
Title Side-Channel Leakage of Cross-Origin Data via WebAuthentication in Chrome on iOS

Wed, 01 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Chrome iOS WebAuthentication Side‑Channel Information Leak

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS WebAuthentication Side‑Channel Information Leak

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T19:04:25.313Z

Reserved: 2026-06-29T23:03:42.994Z

Link: CVE-2026-13889

cve-icon Vulnrichment

Updated: 2026-07-01T15:22:59.210Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-16T00:15:06Z

Weaknesses
  • CWE-20

    Improper Input Validation