CVE-2026-13826 is a medium severity vulnerability in Google Chrome on Android affecting versions prior to 150.0.7871.47. It involves an inappropriate implementation in the Autofill feature that permits a remote attacker, who has already compromised the renderer process, to leak cross-origin data by using a specially crafted HTML page. The vulnerability is related to CWE-352 (Cross-Site Request Forgery) and CWE-346 (Origin Validation Error). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Successful exploitation could lead to unauthorized disclosure of sensitive cross-origin data through the Autofill feature in Chrome on Android. This compromises user privacy and confidentiality but does not affect integrity or availability. The attacker must have already compromised the renderer process and require user interaction to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and consider updating to the latest Chrome version once available.