CVE-2026-13900 is a medium severity vulnerability in Google Chrome affecting the Chromecast component before version 150.0.7871.47. The vulnerability arises from improper validation of untrusted input, enabling a remote attacker with control over the renderer process to bypass navigation restrictions via a crafted HTML page. This could lead to unauthorized navigation actions within the browser context. The vulnerability is tracked under CWE-20 (Improper Input Validation).

The vulnerability allows an attacker who has already compromised the renderer process to bypass navigation restrictions, potentially enabling unauthorized navigation behavior within the browser. There is no indication of confidentiality or availability impact, and no known exploits are reported in the wild.

The vulnerability is fixed in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory, but the affected version is identified as prior to 150.0.7871.47, implying the fix is included in that version. No additional mitigation steps are indicated by the vendor advisory.