CVE-2026-13963 is a vulnerability in the DevTools component of Google Chrome versions before 150.0.7871.47. It allows a remote attacker to leak cross-origin data if a user is tricked into performing certain UI gestures on a maliciously crafted HTML page. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). The CVSS v3.1 base score is 3.1, reflecting low severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact. No known exploits in the wild have been reported. The vendor advisory linked indicates the fixed version is 150.0.7871.47.

Successful exploitation could result in the leakage of cross-origin data from the user's browser to an attacker-controlled page. The impact is limited to confidentiality and does not affect integrity or availability. The attack requires user interaction and has a high complexity, reducing the likelihood of widespread exploitation.

Update Google Chrome to version 150.0.7871.47 or later, where this vulnerability is fixed. Since this is a client-side vulnerability, applying the official update is the recommended remediation. No additional vendor advisories indicate alternative mitigations or that no action is required.