CVE-2026-13816 is a vulnerability in Google Chrome on Android where insufficient validation of untrusted input in the File Input component allows a remote attacker to leak cross-origin data by crafting a malicious HTML page. This issue affects versions prior to 150.0.7871.47. The vulnerability is related to CWE-20 (Improper Input Validation) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation status.

The vulnerability allows remote attackers to leak sensitive cross-origin data by exploiting improper input validation in the File Input feature on affected Chrome versions for Android. This could lead to unauthorized disclosure of information across origins without user privileges or elevated access. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, exercise caution when interacting with untrusted web content on affected Chrome Android versions.