CVE-2026-13862 describes a medium severity vulnerability in Google Chrome on iOS versions before 150.0.7871.47. The vulnerability arises from insufficient policy enforcement in the Web Authentication implementation, specifically affecting Passkeys and Security Keys. An attacker with network-level privileges can exploit this by delivering a crafted HTML page that causes leakage of cross-origin data. This vulnerability is tracked under CWE-693 (Protection Mechanism Failure). No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

Successful exploitation allows an attacker in a privileged network position to leak sensitive cross-origin data from the browser, potentially exposing user information or session data. The vulnerability does not affect integrity or availability, only confidentiality. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of Google Chrome on iOS should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed. Until then, avoid untrusted networks or use VPNs to reduce risk from privileged network attackers.