CVE-2026-13936 is a medium severity vulnerability in Google Chrome on Android versions before 150.0.7871.47. It involves an inappropriate implementation in the password management functionality that enables a remote attacker to extract potentially sensitive information from process memory by delivering a crafted HTML page. The vulnerability does not require privileges and involves user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker can remotely obtain sensitive information from the process memory of the affected Chrome browser on Android by tricking the user into visiting a maliciously crafted HTML page. This could lead to exposure of confidential data stored or processed by the browser's password component. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

No explicit patch or remediation level is confirmed in the vendor advisory. The vendor advisory link is provided but does not specify a fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update to version 150.0.7871.47 or later once available. Until then, exercise caution when interacting with untrusted web content.