CVE-2026-13959
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Risk Assessment
An attacker can bypass same-origin isolation mechanisms, potentially leading to data theft or unauthorized actions in the context of another domain.
Recommendation
Update Google Chrome to version 150.0.7871.47 or later immediately.
Other vulnerabilities in Blink
See all- CVE-2016-5141High
Blink, as used in Google Chrome before version 52.0.2743.116, allows remote attackers to spoof the URL in the address bar via vectors involving a provisional URL for an initially empty document.
- CVE-2026-79216High
Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Medium)
- CVE-2026-13815High
A Use-After-Free vulnerability in the Blink component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The issue is rated as high severity.
Original NVD description (English source)
Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)