CVE-2026-13891 is a vulnerability in Google Chrome's Extensions component affecting versions before 150.0.7871.47. The vulnerability arises from insufficient validation of untrusted input, which can be exploited by a remote attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can perform privilege escalation, potentially gaining higher-level access within the browser environment. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits in the wild have been reported at this time. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation allows an attacker with control over the renderer process to escalate privileges, potentially leading to increased control over the browser or underlying system components. This can compromise confidentiality, integrity, and availability within the affected environment.

A fix is available in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for detailed update instructions.