CVE-2026-13924 is a vulnerability in the WebView component of Google Chrome on Android versions before 150.0.7871.47. It involves insufficient validation of untrusted input, which allows a remote attacker with control over the renderer process to bypass the same origin policy by delivering a specially crafted HTML page. This could lead to unauthorized interactions between different origins within the browser context. The vulnerability is tracked under CWE-20 (Improper Input Validation) and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no explicit vendor advisory stating a patch or remediation level, and no known exploits in the wild have been reported as of the publication date.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass the same origin policy, potentially allowing unauthorized access or manipulation of content across different origins within the browser. This could lead to increased risk of information disclosure or integrity violations within affected WebView contexts. However, the vulnerability does not impact confidentiality directly (C:N), but it has a high impact on integrity (I:H) and no impact on availability (A:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided vendor advisory link does not explicitly confirm a fix or remediation level. Users and administrators should monitor the official Google Chrome release notes and security advisories for updates regarding this vulnerability. Until an official fix is confirmed, limiting exposure to untrusted content in WebView and restricting renderer process compromise vectors may reduce risk.