CVE-2026-13964 is a medium severity vulnerability in Google Chrome's WebView component on Android devices before version 150.0.7871.47. The vulnerability arises from insufficient enforcement of navigation policies, which allows a remote attacker to bypass these restrictions by crafting a malicious HTML page. This could lead to integrity impacts without affecting confidentiality or availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state the availability of a patch or remediation, and no known exploits have been reported.

The vulnerability allows a remote attacker to bypass navigation restrictions in the WebView component of Google Chrome on Android, potentially leading to unauthorized actions that affect the integrity of the browsing session. There is no impact on confidentiality or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation of a fix is available, users should exercise caution when interacting with untrusted content in WebView on affected versions. No specific temporary mitigations are provided by the vendor advisory.