CVE-2026-13932 is a vulnerability in Google Chrome on Android versions before 150.0.7871.47. It stems from an inappropriate implementation in the Sharing functionality that permits a remote attacker with control over the renderer process to leak cross-origin data through a specially crafted HTML page. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 6.5, indicating medium severity. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. The impact is high on confidentiality, with no impact on integrity or availability. The vendor advisory linked does not explicitly state if a fix is available or if users should take any action.

The vulnerability allows unauthorized disclosure of cross-origin data, compromising user confidentiality if the renderer process is already compromised. There is no impact on data integrity or system availability. Exploitation requires user interaction and a compromised renderer process, limiting the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes for updates addressing this vulnerability. Until a patch is confirmed, exercising caution with untrusted content and minimizing renderer process compromise risk is advisable.