CVE-2026-13790: Google Chrome Side-Channel Vulnerability Allows Cross-Origin Data Leakage

Technical summary

CVE-2026-13790 is a side-channel information leakage vulnerability (CWE-1300) in the Scroll implementation of Google Chrome. An unauthenticated remote attacker can craft a malicious HTML page that, when visited by a user, leaks cross-origin data through observable differences in scroll behavior or timing. The vulnerability requires user interaction but no special privileges. The attack surface is broad because any website can host the malicious payload. Google assigned this a High security severity rating; the CVSS 3.1 score of 6.5 (Medium) reflects the confidentiality impact and user-interaction requirement.

Business impact

This vulnerability poses a direct threat to user privacy and organizational security posture. Attackers could harvest authentication tokens, session cookies, personal information, or other sensitive data from cross-origin contexts without users' awareness. For enterprises, this means users who visit a phishing or compromised website could inadvertently leak credentials or information related to internal services or SaaS platforms they're authenticated to. Widespread exploitation could erode user trust and create compliance risks under privacy regulations (GDPR, CCPA, etc.) if user data is exfiltrated at scale.

Affected systems

Google Chrome browsers running version 150.0.7871.47 and earlier are vulnerable. This includes Chrome on Windows, macOS, Linux, Android, and iOS. Any user who has not yet updated to 150.0.7871.47 or later is at risk. Organizations relying on Chrome as their primary browser face exposure across their user base until patches are deployed.

Exploitability

Exploitability is moderate to high. The attack requires no special privileges and does not depend on software vulnerabilities elsewhere on the system. However, it requires user interaction—specifically, a user must visit or be redirected to the attacker's crafted HTML page. This is a realistic threat vector via phishing, drive-by download scenarios, or social engineering. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the published date, but side-channel flaws are often weaponized once details become public.

Remediation

The primary remediation is to update Google Chrome to version 150.0.7871.47 or later. Google typically deploys patches automatically and notifies users of available updates. Organizations should verify that auto-updates are enabled and audit their deployed Chrome versions to identify stragglers. Additionally, encourage users to be cautious about visiting untrusted links or websites, particularly from unsolicited emails or messages.

Patch guidance

Deploy Chrome 150.0.7871.47 or later across all endpoints. Verify the patch version through Chrome's Settings > About Google Chrome, which will display the current version and trigger auto-update if available. For enterprise deployments using Google Admin Console, push the minimum version requirement to Chrome 150.0.7871.47 or newer. Test the patch in a non-production environment to confirm functionality before enterprise rollout. Monitor Chrome release notes for any associated breaking changes.

Detection guidance

Standard log-based detection is limited because this is a browser-level side-channel exploit; no network-layer signatures reliably identify the attack. Focus on behavioral indicators: monitor for users visiting suspicious domains shortly before credential compromise, watch for unusual patterns in session token usage or geographic anomalies, and implement endpoint detection and response (EDR) rules to flag potential data exfiltration. Browser telemetry and sandboxing can help isolate affected devices. Consider supplementing detection with security awareness training to reduce user susceptibility to phishing that delivers the malicious payload.

Why prioritize this

Although the CVSS score is 6.5 (Medium), this vulnerability warrants elevated priority due to its high confidentiality impact, broad user base affected, and low barrier to exploitation (only user interaction required). Side-channel leaks of cross-origin data can expose authentication credentials or sensitive personal information with no obvious artifact on the user's device. The lack of a KEV listing does not diminish urgency—organizations should patch proactively rather than waiting for public exploitation to materialize.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity: the vulnerability has high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N), requires user interaction (UI:R), has low attack complexity (AC:L), requires no privileges (PR:N), and affects only the confidentiality of user data in the victim's security context (S:U). While the score is moderate, the practical risk is elevated because cross-origin data leakage is a persistent privacy threat, and the attack requires only social engineering to deliver.

Frequently asked questions