CVE-2026-13926: Update Chrome to 150.0.7871.47 to Fix Navigation Bypass

CVE-2026-13926 affects Google Chrome before 150.0.7871.47. On Windows, open Chrome ⋮ > Help > About Google Chrome, update to 150.0.7871.47 or later, and relaunch. The Chrome-sourced description says a remote attacker who had already compromised the renderer process could use crafted HTML to bypass navigation restrictions through insufficient validation in the Network component. CISA-ADP scored the issue 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); NVD had not provided its own CVSS assessment.

Chrome version shown	CVE-2026-13926 decision	Required action
Earlier than 150.0.7871.47	Inside the listed affected range	Update Chrome and relaunch
150.0.7871.47	Meets the fixed threshold	Complete any requested relaunch
Later than 150.0.7871.47	Outside the listed affected range	Continue normal update enforcement
Microsoft Edge or another Chromium browser	Chrome’s threshold does not establish status	Check that vendor’s advisory and version guidance

A Medium Rating With a Significant Prerequisite​

CVE-2026-13926 is categorized as insufficient validation of untrusted input in Google Chrome’s Network component. The public description establishes a narrow sequence:

1. The attacker has already compromised the renderer process.
2. Crafted HTML is used.
3. The documented result is a bypass of navigation restrictions.

The renderer-compromise prerequisite is central to understanding the issue. CVE-2026-13926 is not described as the vulnerability that creates that initial compromise, and the supplied record does not explain how an attacker would obtain it. It also does not identify the navigation restriction, the exact validation failure, or the user action represented by the CVSS user-interaction metric.
The supplied NVD description does not describe arbitrary code execution, a sandbox escape, credential theft, data disclosure, denial of service, or operating-system compromise. Those outcomes should not be added to advisories, scanner notes, or incident reports without separate evidence.
Likewise, the record does not establish a complete exploit chain. It supports only the stated finding: after renderer compromise, a remote attacker could use crafted HTML to exploit insufficient validation in the Network component and bypass a navigation restriction.
The CISA-ADP assessment models high integrity impact, with no confidentiality or availability impact. That standardized assessment should not be expanded into a more detailed technical outcome than the vulnerability description provides. The precise behavior altered by the navigation bypass remains undisclosed.
The associated Chromium issue is permission-restricted, limiting independent review of the underlying mechanics. The supplied information does not explain why access is restricted or when additional details might become public.

The Renderer Requirement Changes the Threat, Not the Update Decision​

The phrase “had compromised the renderer process” is a required condition, not incidental wording. Security communications should retain it whenever summarizing the CVE.
That condition means the issue is not presented as a stand-alone path from encountering HTML to compromising Chrome or Windows. The CVE record does not name a companion vulnerability, campaign, proof of concept, or technique that supplies the required renderer compromise.
This limitation does not change the version-based remediation decision. A Chrome installation below 150.0.7871.47 remains within the listed affected range even though exploitation depends on a prior condition.
CISA-ADP’s Stakeholder-Specific Vulnerability Categorization snapshot records:

• Exploitation: none
• Automatable: no
• Technical impact: partial

These are the recorded values in the supplied data. They should be reported as written rather than interpreted as guarantees about whether exploitation is possible, whether private research exists, or how reliably an attack could be scaled.
There is no basis in the supplied record for treating every affected Chrome installation as evidence of compromise. The appropriate response is to remediate the affected version and reserve incident declarations for cases supported by additional telemetry or authoritative threat information.

The Version Boundary Is the Operational Story​

Google Chrome versions before 150.0.7871.47 are listed as affected. Version 150.0.7871.47 meets the fixed threshold, and numerically later versions are outside the supplied affected range.
The complete version matters because the affected boundary is expressed as a four-part number. An inventory entry that reports only “Chrome 150” cannot establish whether the installation is below, equal to, or above 150.0.7871.47.
For example:

• 150.0.7871.46 is below the threshold and remains affected.
• 150.0.7871.47 meets the threshold.
• 150.0.7871.48 is later than the threshold.

Administrators should compare each version component numerically from left to right. They should not treat the version as a decimal number or compare it only by its major release.
The supplied record names Google Chrome. It does not provide corrected-version information for Microsoft Edge, Brave, Vivaldi, Opera, or other Chromium-derived browsers. Shared Chromium code does not make Chrome’s product version a universal remediation threshold.
For non-Chrome browsers, avoid both unsupported conclusions:

• Do not declare the product affected solely because it uses Chromium.
• Do not declare the product fixed because Google Chrome reached 150.0.7871.47.

Use the relevant vendor’s advisory, affected-product statement, and corrected build. Chrome’s threshold applies to the Google Chrome product identified in the record; there is no valid Chrome-to-Edge version mapping in the supplied information.

How Windows Users Can Verify the Fix​

Windows users can check Chrome directly:

1. Open Google Chrome.
2. Select the three-dot menu ⋮ in the upper-right corner.
3. Select Help.
4. Select About Google Chrome.
5. Allow the update check to finish.
6. Confirm the displayed version is 150.0.7871.47 or later.
7. If Chrome presents Relaunch, save important browser work and select it.
8. After Chrome reopens, return to Help > About Google Chrome and confirm the displayed version.

The relaunch instruction is part of the practical completion workflow because Chrome explicitly presents that action when required. The available record does not support broader claims about the relationship between installed packages and individual running browser processes, so remediation reporting should remain tied to the observable result: Chrome has reopened and displays a compliant version.
Enterprise administrators may use their established endpoint-management, software-inventory, or Chrome-management systems, provided the selected source reports the complete version accurately. The supplied CVE record does not designate a particular registry path, command, management console, or product as authoritative.
A useful fleet query separates devices into four groups:

Fleet status	Administrative treatment
Chrome below 150.0.7871.47	Remediation required
Chrome at or above 150.0.7871.47	Version requirement met
Chrome version incomplete or stale	Compliance not established
Device offline or missing from inventory	Keep open for verification

Deployment status alone is not the final evidence. “Update approved,” “policy assigned,” and “installation scheduled” describe progress but do not report the resulting Chrome version. Close remediation only when current evidence shows that the endpoint has reached the fixed boundary.
Where inventory records only the major version, administrators should improve the query or perform direct verification. A report of “Chrome 150” lacks the precision needed for this CVE.

Public Information Supports a Narrow Interpretation​

The source discipline for CVE-2026-13926 can be reduced to four established points:

• Google Chrome versions before 150.0.7871.47 are affected.
• The attacker is assumed to have already compromised the renderer process.
• Crafted HTML can then be used to bypass navigation restrictions through insufficient validation in the Network component.
• CISA-ADP contributed the 6.5 Medium CVSS 3.1 assessment and an SSVC snapshot recording exploitation as none, automatable as no, and technical impact as partial; NVD had not supplied its own CVSS score.

Important details remain unknown, including the navigation restriction involved, the exact user interaction, the method of obtaining the prerequisite renderer compromise, the internal exploit mechanics, any distinctive forensic artifacts, and whether a complete exploit chain exists.
This evidence boundary rules out several tempting but unsupported descriptions. The supplied record does not establish that CVE-2026-13926 bypasses enterprise URL filtering, administrative allowlists, identity controls, site isolation, endpoint security software, or a named Chrome policy. It does not establish applicability to Microsoft Edge or every Chromium-derived browser. It also does not identify active attacks, a public proof of concept, or a specific delivery campaign.
A defensible technical summary is therefore:

Google Chrome before 150.0.7871.47 contains an insufficient-validation vulnerability in the Network component. According to the Chrome-sourced description, a remote attacker who had already compromised the renderer process could use crafted HTML to bypass navigation restrictions.

That description preserves the affected product, prerequisite, input, component, weakness, and documented consequence without filling undisclosed gaps with generic browser-architecture explanations.

Severity Labels Should Inform, Not Replace, the Decision​

CISA-ADP scored the issue 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); NVD had not provided its own CVSS assessment.
That attribution matters because NVD displays vulnerability data supplied by multiple contributors. A score appearing on an NVD page is not necessarily a score authored by NVD or NIST. Internal tickets and reports should label 6.5 Medium as the CISA-ADP CVSS 3.1 assessment, not simply the “NVD score.”
The CVSS vector records a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. These are standardized scoring selections, not a complete exploit narrative.
CVE-2026-13926 is also associated with CWE-20, Improper Input Validation. That broad weakness category does not reveal the exact object, field, request, policy, or navigation state that was validated incorrectly.
For vulnerability-management teams, a concise ticket summary is:

Google Chrome before 150.0.7871.47 contains a Network-component input-validation flaw that can allow a remote attacker with a previously compromised renderer to bypass navigation restrictions through crafted HTML. CISA-ADP scores the issue 6.5 Medium; the supplied record contains no separate NVD CVSS assessment. Update Chrome to 150.0.7871.47 or later and complete the requested relaunch.

Admin Checklist​

• [ ] Identify Windows endpoints with Google Chrome installed.
• [ ] Collect the complete four-part Chrome version from a trusted inventory source.
• [ ] Mark every version below 150.0.7871.47 as affected.
• [ ] Deploy or allow the Chrome update through the organization’s established process.
• [ ] Require users to select Relaunch when Chrome presents that action.
• [ ] Recheck the version after Chrome reopens.
• [ ] Keep systems with incomplete, stale, or major-version-only inventory open for verification.
• [ ] Follow up on offline devices and installations that remain below the threshold.
• [ ] Record the 6.5 Medium score as a CISA-ADP CVSS 3.1 assessment, not an NVD-authored score.
• [ ] Preserve the renderer-compromise prerequisite in security notices and tickets.
• [ ] Do not describe an affected installation as proof of exploitation without additional evidence.
• [ ] Do not apply Chrome’s 150.0.7871.47 threshold to Microsoft Edge or another browser.
• [ ] Check each non-Chrome browser against its own vendor’s security guidance.
• [ ] Monitor authoritative information for changes in affected-product scope or exploitation status.

A Bounded, Verifiable Response​

CVE-2026-13926 has a substantial prerequisite and a narrowly described outcome. The attacker must already have compromised the renderer process, and the documented result is a crafted-HTML bypass of navigation restrictions. The supplied NVD description does not describe arbitrary code execution, a sandbox escape, or operating-system compromise.
The remediation boundary is considerably clearer than the undisclosed technical mechanics. Chrome installations below 150.0.7871.47 are affected; Chrome 150.0.7871.47 and later meet the stated threshold. Windows users can verify that result through Chrome ⋮ > Help > About Google Chrome and complete the relaunch Chrome requests.
For organizations, the main operational question is whether current inventory can prove that each Chrome installation has reached the corrected version. Devices with lower, incomplete, or stale version data should remain in the remediation queue. Other Chromium-derived browsers require separate vendor guidance rather than a translated Chrome build number.
Future disclosure may clarify the affected navigation restriction, exploitation mechanics, or threat activity. Until then, reporting should remain within the supplied evidence while remediation proceeds against the exact Chrome version boundary.

---

References​

1. Primary source: NVD / Chromium
   Published: 2026-07-11T15:41:13-07:00
   
   

   NVD - CVE-2026-13926

   nvd.nist.gov
2. Security advisory: MSRC
   Published: 2026-07-11T15:41:13-07:00
   Original feed URL
   
   

   Security Update Guide - Microsoft Security Response Center

   msrc.microsoft.com
3. Related coverage: cvefeed.io
   
   

   CVE-2026-13926 - Google Chrome: Navigation Restriction Bypass

   Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

   cvefeed.io