The vulnerability CVE-2026-13806 in Google Chrome arises from insufficient validation of untrusted input within the Accessibility feature. This flaw permits a remote attacker, with control over the renderer process, to bypass the browser's site isolation security mechanism by leveraging a specially crafted HTML page. Site isolation is a critical security feature designed to separate different websites into distinct processes to prevent data leakage and cross-site attacks. The CVSS score of 8.1 reflects the high impact on confidentiality and integrity, with no privileges required and user interaction needed. The vulnerability is identified as CWE-20 (Improper Input Validation).

Successful exploitation allows an attacker who has already compromised the renderer process to bypass site isolation, potentially leading to unauthorized access to data from other sites within the browser. This undermines a key security boundary in Chrome, increasing the risk of data leakage and cross-site attacks. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

The vulnerability affects Chrome versions prior to 150.0.7871.47. Users and administrators should update to version 150.0.7871.47 or later to remediate this issue. The vendor advisory linked does not explicitly state the patch status, but the affected version indicates that the fix is included in 150.0.7871.47. Patch status is not yet confirmed explicitly in the advisory; therefore, check the vendor advisory for the latest remediation guidance.