CVE-2026-13937
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile — higher than 11% of all known CVEs
Summary
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Risk Assessment
The risk involves potential theft of sensitive credentials or other cross-origin data, which could lead to user account compromise and data leakage within the organization.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later. Ensure the update is deployed on all workstations in the organization.
Original NVD description (English source)
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)