CVE-2026-13900: Insufficient validation of untrusted input in Google Chrome
CVE-2026-13900 is a medium severity vulnerability in Google Chrome's Chromecast implementation prior to version 150.0.7871.47. It allows a remote attacker who has compromised the renderer process to bypass navigation restrictions using a crafted HTML page. This issue arises from insufficient validation of untrusted input. No CVSS score is provided, and no explicit patch or remediation level is stated in the available data.
AI Analysis
Technical Summary
The vulnerability CVE-2026-13900 affects Google Chrome versions before 150.0.7871.47. It is caused by improper validation of untrusted input in the Chromecast feature, enabling an attacker with control over the renderer process to bypass navigation restrictions via a specially crafted HTML page. The Chromium security team rates this issue as medium severity. There is no explicit information about an official patch or remediation level in the provided data, but the affected version list includes 150.0.7871.47, implying that this version addresses the issue. The vendor advisory link is provided but does not specify patch details in the input.
Potential Impact
An attacker who has already compromised the renderer process in Chrome can exploit this vulnerability to bypass navigation restrictions, potentially allowing unauthorized navigation actions within the browser context. This could lead to further exploitation or unauthorized behavior within the affected browser session. The severity is medium as per Chromium security classification.
Mitigation Recommendations
The affected version is prior to 150.0.7871.47, indicating that updating to version 150.0.7871.47 or later should remediate the vulnerability. Since no explicit remediation level or patch status is stated in the input, users should consult the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for confirmation and apply the update accordingly.
CVE-2026-13900: Insufficient validation of untrusted input in Google Chrome
Description
CVE-2026-13900 is a medium severity vulnerability in Google Chrome's Chromecast implementation prior to version 150.0.7871.47. It allows a remote attacker who has compromised the renderer process to bypass navigation restrictions using a crafted HTML page. This issue arises from insufficient validation of untrusted input. No CVSS score is provided, and no explicit patch or remediation level is stated in the available data.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-13900 affects Google Chrome versions before 150.0.7871.47. It is caused by improper validation of untrusted input in the Chromecast feature, enabling an attacker with control over the renderer process to bypass navigation restrictions via a specially crafted HTML page. The Chromium security team rates this issue as medium severity. There is no explicit information about an official patch or remediation level in the provided data, but the affected version list includes 150.0.7871.47, implying that this version addresses the issue. The vendor advisory link is provided but does not specify patch details in the input.
Potential Impact
An attacker who has already compromised the renderer process in Chrome can exploit this vulnerability to bypass navigation restrictions, potentially allowing unauthorized navigation actions within the browser context. This could lead to further exploitation or unauthorized behavior within the affected browser session. The severity is medium as per Chromium security classification.
Mitigation Recommendations
The affected version is prior to 150.0.7871.47, indicating that updating to version 150.0.7871.47 or later should remediate the vulnerability. Since no explicit remediation level or patch status is stated in the input, users should consult the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for confirmation and apply the update accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-06-29T23:03:47.463Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","vendor":"Google"}]
Threat ID: 6a444c1d27e9c7971985cc4a
Added to database: 06/30/2026, 23:07:09 UTC
Last enriched: 07/01/2026, 03:22:22 UTC
Last updated: 07/01/2026, 03:22:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.