External risk intelligence

Chrome for iOS Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-13843

This vulnerability is located in the client-side renderer process of the Chrome for iOS application. Exploitation requires a user to navigate to a crafted HTML page within the browser. As a client-side application feature, it is not a public-facing service, gateway, or internet-accessible infrastructure component.

Google Chrome

before 150.0.7871.47

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in Chrome for iOS that could allow an attacker to escape the browser's security sandbox if a user visits a specially crafted webpage. This could potentially impact user data and system integrity if exploited.

Allows browser escape via malicious web pages.
Matters if sensitive data is handled in Chrome.
Confirm relevance and then assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by luring a user to a malicious website. If the user visits this site using a vulnerable version of Chrome on iOS, the attacker could leverage a compromised renderer process to escape the sandbox. This could lead to the execution of arbitrary code and the compromise of user data.

Requires user interaction with a malicious page.
Crafted HTML triggers sandbox escape.
Potential for data theft and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker who has already compromised the renderer process to escape the sandbox when a user visits a crafted HTML page. This could affect system data and user data, as well as service behavior.

System and user data could be affected.
Crafted HTML page could trigger exposure.
Sandbox escape, affecting system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Chrome for iOS, a client-side application. Responsibility for addressing this will likely fall to teams managing mobile device security and application deployment, potentially including device administrators, mobile application management (MAM) teams, or endpoint security teams, in coordination with the vendor. The immediate first step is to identify which iOS devices have the affected version of Chrome installed and determine their criticality and exposure.

Own by mobile/endpoint security teams.
Verify affected Chrome for iOS installations.
Plan phased rollout based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chrome for iOS?

Chrome for iOS is the mobile web browser application developed by Google for Apple's mobile operating system. Unlike desktop versions, it utilizes the required WebKit rendering engine to display web content, allowing users to browse, sync bookmarks, and manage account settings across their mobile devices.

How does CVE-2026-13843 allow a sandbox escape?

This vulnerability involves Improper Input Validation, categorized as CWE-20. It occurs because the browser does not sufficiently check untrusted data. By using a specially crafted HTML page, an attacker can manipulate the renderer process—the part of the browser that displays page content—to break out of the security sandbox, which is meant to keep web content isolated from the rest of the system.

Do I need to do anything if I am just opening safe websites?

The vulnerability is triggered by visiting a crafted HTML page, which means standard web browsing of trusted sites does not inherently activate the flaw. However, the risk arises when a user is lured to malicious content. Simply opening the browser or using it for known safe tasks does not trigger the sandbox escape, as it requires the specific malicious interaction described.

Is my device vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that this is very unlikely to pose a risk to your infrastructure. Because the flaw exists within the client-side renderer process of the Chrome for iOS app, it is not a gateway, server, or internet-accessible service that you would manage in a traditional data center sense; it is an end-user application.

When should I update Chrome for iOS?

You should prioritize updating as soon as a new version is available through the App Store. The first step for anyone managing mobile devices is to identify which iOS devices have the older, vulnerable version of Chrome installed. Once identified, plan to deploy the update across your fleet to ensure the sandbox protection is restored and system integrity is maintained.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.