Google Chrome CVE-2026-13863

Exploitation requires local access to the Android device and involves Chrome's CustomTabs feature: an attacker (typically a malicious app already installed on the device, or a malicious file placed on it) must supply crafted untrusted input via a file, and the victim must perform an interaction that causes Chrome to process it (CVSS UI:R). Limiting factors: the attacker needs a foothold on the device (a malicious/colluding app or an attacker-controlled file), the target must be running Chrome for Android below 150.0.7871.47, and user interaction is mandatory - there is no remote, unauthenticated, or zero-click path. The issue is Android-specific and does not affect desktop Chrome.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8 High) describes a local, low-complexity, no-privilege attack that nonetheless requires user interaction and yields high confidentiality, integrity, and availability impact. The real-world signals temper this: EPSS is only 0.13% (3rd percentile), the vulnerability is not in CISA KEV, and no public exploit code has been identified, indicating this is not currently a widespread or automated threat. Google's own Chromium severity rating of Medium is notably lower than the 7.8 NVD score, reflecting that exploitation requires local presence (a malicious file/app already on the device) plus user interaction - meaningful limiting factors. This is a routine-priority patch for a ubiquitous product rather than an emergency; the primary residual concern is the sheer install base of Chrome on Android.

A user installs a malicious or compromised Android app; when the user taps a link or content that opens in a Chrome CustomTab, the app passes a crafted malicious file whose untrusted input Chrome fails to validate, letting the attacker escalate privileges within the browser context on the device. The single required user interaction is realistic during normal app usage. No public proof-of-concept has been identified.