Google Chrome CVE-2026-13927

Exploitation requires local access to the device and user interaction: the victim must open a specifically crafted malicious file in a vulnerable Chrome for Android build prior to 150.0.7871.47 (CVSS UI:R and AV:L). No pre-existing privileges are needed (PR:N), but the attacker cannot trigger it remotely or without the user action of opening the file. Limiting factors that reduce real-world risk: the local-only vector, the mandatory user interaction, the platform constraint (Android build per the description), and SSVC Automatable: no, meaning it cannot be reliably automated at scale.

Signals point toward moderate, not urgent, priority. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local vector requiring user interaction (opening a malicious file) but no prior privileges, with high impact to confidentiality, integrity and availability, producing the 7.8 base score. However EPSS is only 0.13% (3rd percentile) and SSVC records Exploitation: none and Automatable: no, indicating no observed exploitation and no scalable, wormable path; SSVC Technical Impact: total aligns with the high CVSS impacts. There is no CISA KEV listing and no POC signal, so this is a real but locally-scoped privilege-escalation issue best handled via routine patching rather than emergency response. Note the tension worth flagging: Chromium graded this Medium while the aggregated CVSS is High (7.8) - the local vector and required user interaction explain the vendor's lower severity view.

An attacker crafts a malicious file and delivers it to a victim (for example via a download, messaging app, or shared storage on the Android device). When the user opens the file in a vulnerable Chrome build, the browser's insufficient input validation lets the file escalate privileges within the local context. No public exploit code has been identified at time of analysis, and the local vector plus required user interaction (AV:L/UI:R) make this an opportunistic rather than scalable attack.