CVE-2026-13886

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47

Description Insufficient policy enforcement in Isolated Web Apps allows a remote attacker to bypass the content security policy (CSP), which is a security layer used to detect and mitigate certain types of attacks, such as cross-site scripting, by restricting the resources that a browser is allowed to load. This bypass can be achieved through the use of a crafted HTML page.

Recommendations Update Google Chrome to version 150.0.7871.47 or later.