CVE-2026-13887

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47

Description An inappropriate implementation in the Near Field Communication (NFC) component allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved by using a specially crafted HTML page. Cross-origin data leakage occurs when a script from one origin accesses data from another origin, violating the Same-Origin Policy (SOP), a security mechanism that prevents websites from interacting with data from other sites without permission.

Recommendations Update Google Chrome on Android to version 150.0.7871.47 or later.