CVE-2026-13836 describes a cross-site scripting vulnerability in Google Chrome caused by inappropriate CSS implementation. This flaw allows remote attackers to inject arbitrary scripts or HTML content through crafted HTML pages, leading to UXSS attacks. The issue affects versions of Chrome prior to 150.0.7871.47. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. The vendor advisory is available but does not explicitly state if a fix has been issued.

Successful exploitation could allow remote attackers to execute arbitrary scripts or inject HTML in the context of the victim's browser, potentially leading to information disclosure or manipulation of web content. The impact is limited to confidentiality and integrity with no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation of a fix, users should exercise caution when visiting untrusted websites and consider updating to Chrome version 150.0.7871.47 or later if available.