CVE-2026-13924
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile — higher than 24% of all known CVEs
Summary
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
Risk Assessment
An attacker can bypass same-origin policy, potentially leading to data theft or unauthorized access to resources within the browser context.
Recommendation
Update Google Chrome on Android to version 150.0.7871.47 or later immediately, which includes a fix for this vulnerability.
Original NVD description (English source)
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)