The vulnerability CVE-2026-13921 affects Google Chrome versions before 150.0.7871.47. It arises from insufficient validation of untrusted input in the DeviceBoundSessionCredentials component. Exploitation enables a remote attacker to bypass the same origin policy by delivering a specially crafted HTML page. The CVSS score is 6.5 (medium severity), indicating a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, but high integrity impact and no availability impact. There is no explicit vendor advisory stating a patch or fix is available, and the provided patchLinks array is empty. The vendor advisory URL points to a Chrome stable channel update announcement but does not confirm remediation status for this specific issue. No known exploits in the wild have been reported.

Successful exploitation allows a remote attacker to bypass the same origin policy in affected versions of Google Chrome, potentially enabling unauthorized modification of data or actions within the browser. The integrity of user data or browser state can be compromised without affecting confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious HTML content that could exploit this vulnerability.