This vulnerability (CVE-2026-13914) affects Google Chrome on Mac platforms before version 150.0.7871.47. It arises from an inappropriate implementation in the password handling functionality, which permits a local attacker to extract sensitive information from process memory through a crafted malicious file. The CVSS 3.1 base score is 5.5 (medium), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and high confidentiality impact. The issue is tracked under CWE-284 (Improper Access Control). The vendor has published an advisory indicating a stable channel update that presumably includes a fix, although explicit patch status is not stated in the input data.

An attacker with local access and the ability to trick a user into opening a malicious file can obtain sensitive password-related information from Chrome's process memory. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

A fix is available in Google Chrome version 150.0.7871.47. Users should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for detailed update instructions. No additional mitigation steps are indicated by the vendor advisory.