Google has patched a worrying security flaw in its Chrome browser for iOS, and the advisory is terse enough to raise eyebrows. The vulnerability, tracked as CVE-2026-13917, affects all versions of Chrome for iOS prior to 150.0.7871.47. If you use an iPhone or iPad with Chrome installed, you need to update—right now.

What we know about the vulnerability

The official advisory from Google is brief: “Affected: Chrome for iOS versions earlier than 150.0.7871.47 are affected by CVE-2026-13917. Action: Update or require Chrome for iOS 150.0.7871.47 or later, then use current application inventory to…” The truncation appears intentional, urging organizations to take inventory, but Google hasn’t yet filled in the blanks on what the flaw actually allows an attacker to do. That’s not unusual—vendors often withhold technical details to give users time to patch before bad actors can reverse-engineer the fix. But the lack of a severity rating or a bug description leaves users to guess: is this a sandbox escape? A remote code execution bug? Something else?

Until Google publishes more details, treat this as a high-priority update. The version jump to 150.0.7871.47 hints at a significant fix, not a routine polish. CVE identifiers are sequential, and a 2026 assignment simply means the bug was reported and reserved a while ago. What matters now is that the patch is out, and the clock is ticking.

What it means for you

For everyday users, the risk is straightforward: if you haven’t updated Chrome on your iPhone or iPad, any malicious website or crafted link could potentially exploit the bug to run code, steal data, or crash the browser. The attack surface is wide—Chrome for iOS is among the most downloaded third-party browsers, syncing with millions of Google accounts. A compromise on your mobile browser could leak passwords, browsing history, or even logged-in session tokens to an attacker.

Enterprise administrators face a trickier challenge. The truncated advisory snippet (“…then use current application inventory to”) clearly targets managed fleets. With the rise of bring-your-own-device (BYOD) policies, IT teams must ensure that every employee’s iPhone or iPad running Chrome is on version 150.0.7871.47 or later. Failure to do so could expose corporate credentials, internal web apps, and sensitive communications. Many mobile device management (MDM) solutions can forcibly update apps or restrict access to corporate resources until a minimum version is met. If you manage iOS devices, now is the time to audit.

How we got here

Chrome for iOS has consistently lagged behind its desktop cousin in update frequency—not because of neglect, but because of Apple’s platform rules. All browsers on iOS must use Apple’s WebKit engine, meaning Chrome on iOS is essentially a wrapper around Safari’s rendering core, with Google’s syncing, search, and security features layered on top. Vulnerabilities in that wrapper can be just as dangerous as those in the renderer. Past bugs, like CVE-2021-37973 (a zero-day exploited in the wild), showed that Chrome for iOS can be a vector for real attacks.

Google typically pushes security fixes for Chrome on a predictable schedule, but out-of-band updates—like this one—often signal an urgency that suggests active exploitation or a critical bug that can’t wait for the next release cycle. While Google hasn’t confirmed in-the-wild attacks for CVE-2026-13917, the language in the advisory and the immediate demand for inventory checks indicate the company is taking no chances.

How to update Chrome on iOS

The update process is simple, but many users delay it or ignore app updates entirely. Here’s a quick walkthrough:

  1. Open the App Store on your iPhone or iPad.
  2. Tap your profile picture (top right).
  3. Scroll down to see a list of pending updates. If Chrome appears, tap “Update.” If you see “Open,” you’re already on the latest version.
  4. After the update, verify the version: open Chrome, tap the three-dot menu > Settings > Google Chrome. The version number appears at the bottom. It should say 150.0.7871.47 or higher.

To minimize your exposure in the future, enable automatic updates: go to Settings > App Store and toggle on App Updates under Automatic Downloads. Note that iOS may delay auto-updates to save battery or when on cellular data, so you might still be unprotected for hours or days after a release. For critical patches like this one, manual checking is the surest bet.

For IT admins: inventory and enforcement

The “application inventory” reference in the advisory is no accident. Enterprises that manage iOS devices should:

  • Use their MDM console (such as Microsoft Intune, Jamf, or Workspace ONE) to report which devices have Chrome installed and what version each is running.
  • Set a compliance policy requiring Chrome for iOS to be at version 150.0.7871.47 or later.
  • For devices that fail the version check, block access to corporate data or force the update via the App Store’s managed distribution.
  • Communicate the urgency to employees: a short email or Slack notification with a link to the App Store can dramatically shorten the patching window.

Some MDM platforms support “minimum app version” settings that automatically hide or block apps that are out of date. If yours does, deploy that rule now. If your organization uses Google Workspace, the update is also relevant for users who sign into corporate accounts through Chrome on iOS.

Outlook: what to watch next

Two threads deserve attention. First, Google will likely publish a detailed CVE entry once the patch has saturated the user base. That disclosure will reveal the vulnerability’s severity and whether it was exploited in the wild. If the bug turns out to be a zero-day, expect additional scrutiny from security researchers and possibly a follow-up patch for lingering edge cases.

Second, the push for mobile browser updates—especially on iOS—highlights a growing tension between platform security and third-party app maintenance. Apple’s forthcoming enforcement of new privacy labels and mandatory update requirements may shift how quickly critical patches reach users, but for now, the responsibility sits squarely with you.

For Windows users who carry an iPhone, remember that a breach on mobile can cascade across synced devices. If you use the same Google account on Chrome desktop and mobile, resetting your password and reviewing recent account activity after updating is a wise precaution.

Update now, tell a friend, and keep an eye on that version number.