CVE-2026-13863 describes a security vulnerability in Google Chrome for Android where insufficient validation of untrusted input in the CustomTabs feature can be exploited by a local attacker to escalate privileges using a malicious file. The vulnerability affects versions prior to 150.0.7871.47. The CVSS v3.1 base score is 7.8, indicating high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory is linked but does not explicitly state the presence of a patch or remediation level.

Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on the affected Android device, potentially leading to full compromise of the Chrome environment and access to sensitive data or system functions. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted files and avoid local attack vectors where possible.