CVE-2026-13913 is a medium severity vulnerability in Google Chrome on iOS affecting versions before 150.0.7871.47. It arises from insufficient policy enforcement in the Autofill functionality, enabling a remote attacker who convinces a user to perform specific UI gestures to leak cross-origin data through a crafted HTML page. The vulnerability is classified under CWE-346 (Insufficient Authorization). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. There is no evidence of known exploits in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Successful exploitation can lead to unauthorized disclosure of sensitive cross-origin data from the browser's Autofill feature on affected iOS Chrome versions. There is no impact on data integrity or system availability. The attacker requires user interaction and must convince the user to perform specific UI gestures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome release blog does not explicitly state that this vulnerability is fixed in any released version. Users should monitor official Google Chrome updates for iOS and apply updates promptly once a fix is confirmed. Until then, caution users against interacting with untrusted web pages that may attempt to exploit this vulnerability.