CVE-2026-13886 describes a medium severity vulnerability in Google Chrome's Isolated Web Apps component before version 150.0.7871.47. The flaw involves insufficient enforcement of content security policies, enabling a remote attacker to bypass these policies by delivering a specially crafted HTML page. This could lead to unauthorized script execution or other policy circumvention within the isolated web app environment. The vulnerability is tracked under CWE-693 (Protection Mechanism Failure).

The vulnerability allows an attacker to bypass content security policies in Isolated Web Apps, potentially enabling unauthorized script execution or other actions that violate intended security restrictions. However, the CVSS score of 6.5 and the medium severity rating indicate that while the impact on integrity is high, there is no direct confidentiality or availability impact. No known exploits are reported in the wild at this time.

A fixed version of Google Chrome addressing this vulnerability is version 150.0.7871.47. Users and administrators should update to this version or later to remediate the issue. The vendor advisory linked should be consulted for official update guidance. Patch status is not explicitly confirmed in the advisory metadata, so verifying the update availability from the vendor advisory is recommended.