CVE-2026-13795(apple / chrome)

One tap was enough to bypass a Chrome for iOS security check. We found a way to use shortcuts to reach tel: or facetime: without Chrome applying its normal user-interaction checks to the final URL. The issue, CVE-2026-13795, has been fixed. Details 👇 https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html #appsec #doyensec #security #ios

one tap in Chrome for iOS. the phone dials. CVE-2026-13795. Chrome prompts on random app schemes. shortcuts:// gets a free pass. x-error fires after the shortcut fails. tel: never goes back through Chrome. direct tel: needed a recent tap. this path does not. same trick works for facetime:. fixed by prompting before any shortcuts:// or workflow://. credit: Leonardo Giovannini / Doyensec https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html #iOS #AppSec #InfoSec

CVE-2026-13795: A single tap on a malicious webpage bypassed Chrome for iOS call-initiation protections by routing tel: through Apple Shortcuts as a callback, triggering phone calls without user confirmation. - Chrome for iOS explicitly guards tel: and facetime: URLs via a user-gesture check in app_launcher_tab_helper.mm, but it granted shortcuts:// and its legacy alias workflow:// unconditional trust as Apple-native apps, skipping the confirmation prompt entirely. - The attack chain: malicious anchor tag pointing to shortcuts://run-shortcut?name=nonexistent&x-error=tel%3A%2F%2FNUMBER, one tap sends Chrome to Shortcuts, the nonexistent shortcut errors, Shortcuts fires the x-error callback directly to iOS, and Chrome never sees the tel: URL. facetime: works the same way. - The bypass is clean because Shortcuts calls UIApplication openURL for the callback itself. Chrome approved step one and was never consulted for step two, the step that caused the sensitive action. - The Chromium fix (issue 476591032, change 7838361) moves the prompt to the first handoff: Chrome now alerts before opening any shortcuts:// or workflow:// URL, covering x-success, x-cancel, and x-error in one stroke. Hunt for this in mobile threat triage: look for single-tap navigations to shortcuts:// or workflow:// containing URL-encoded tel: or facetime: parameters in query strings. Patch Chrome for iOS to the version including change 7838361. #DFIR_Radar