CVE-2026-6313

CVE-2026-6313 is a Cross-Origin Resource Sharing (CORS) policy enforcement flaw in Google Chrome versions prior to 147.0.7727.101 that permits unauthorized cross-origin data leakage. An attacker who has successfully compromised the renderer process can exploit this vulnerability by serving a crafted HTML page to extract sensitive data from cross-origin sources. This vulnerability carries a Chromium security severity rating of High. The attack requires network access and user interaction, with high complexity due to the prerequisite of renderer process compromise. The CVSS 3.1 score of 3.1 (Low) reflects limited impact, as the vulnerability only enables confidentiality breaches without affecting system integrity or availability. The attack surface is restricted to users who encounter the malicious HTML content while running the vulnerable Chrome version. Exploitation status indicates this vulnerability is not currently being actively exploited in the wild, with no public exploit code readily available and minimal community attention. The vulnerability maintains an inactive status on KEV tracking systems, and the exceptionally low EPSS score of 0.0001 suggests negligible real-world exploitation risk at this time. Users should update to Chrome 147.0.7727.101 or later to remediate the vulnerability.