CVE-2026-13921 is a vulnerability in Google Chrome affecting versions before 150.0.7871.47. It involves insufficient validation of untrusted input within the DeviceBoundSessionCredentials component. This weakness permits a remote attacker to bypass the same origin policy by delivering a specially crafted HTML page. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to sensitive information or actions across origins. The vulnerability is rated medium severity by Chromium security. There is no CVSS score available, and no public exploit is known at this time. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Successful exploitation allows a remote attacker to bypass the same origin policy in affected versions of Google Chrome. This could enable unauthorized access or interaction with content from different origins, potentially leading to information disclosure or other security violations. However, no known exploits are reported in the wild, and the severity is assessed as medium.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed fixed. Until then, exercise caution when browsing untrusted content.