CVE-2026-13922: Chrome Paint Side-Channel Data Leakage (CVSS 6.5)

Technical summary

CVE-2026-13922 is a side-channel information leakage vulnerability in the Paint rendering component of Google Chrome. The vulnerability stems from CWE-1300 (Information Exposure Through Micarchitectural Timing Side Channels) and permits a remote, unauthenticated attacker to infer cross-origin sensitive data by analyzing timing or other side-channel artifacts during the rendering of a crafted HTML page. The attack surface is low (network-accessible, no special privileges needed), but exploitation requires user interaction. The vulnerability has a CVSS 3.1 score of 6.5 (Medium severity) with high confidentiality impact, no integrity or availability impact.

Business impact

This vulnerability primarily threatens user privacy rather than system availability or service integrity. Organizations with users who visit untrusted websites face risk of credential theft, session hijacking, or leakage of sensitive personal or financial information stored in the browser. For enterprises managing shared or public-facing Chrome deployments, the attack is practical if users can be socially engineered to visit a malicious site. Remediation is straightforward and carries minimal operational risk, making delayed patching difficult to justify.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The vulnerability affects all platforms (Windows, macOS, Linux, Android, iOS) on which Chrome is available. Chromium-based browsers and derivatives should be evaluated by their respective vendors. Chrome's automatic update mechanism means most user instances will receive patches within days; enterprises with controlled rollouts should prioritize this update.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing a user to visit it while using a vulnerable Chrome version. There is no indication of exploit code in the wild or inclusion on the CISA KEV catalog. The attack does not require the user to perform additional actions beyond visiting the page, making it moderately practical for opportunistic attackers. The side-channel nature makes reliable exploitation dependent on browser state, timing precision, and target data predictability; not every attempt will succeed.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update feature will handle patching for most users; verify completion via chrome://version in the address bar. Enterprise administrators should test the update in a controlled environment and use Chrome's managed rollout features (if available) to ensure stability before full deployment. No workarounds exist; patching is the only mitigation.

Patch guidance

Install Chrome version 150.0.7871.47 or later. For Windows and macOS, updates typically roll out automatically and restart Chrome to apply. Linux and Android users may need to trigger updates manually through their package manager or app store. Enterprises using Chrome Enterprise should consult their admin console for managed deployment options and verify update success across all deployed instances. Test any custom extensions for compatibility with the new version before pushing enterprise-wide.

Detection guidance

Monitor Chrome version distributions across your infrastructure to confirm migration to 150.0.7871.47 or later. Endpoint Detection and Response (EDR) tools may flag suspicious timing-based probing or unusual rendering patterns, but side-channel attacks are inherently difficult to detect post-hoc. Focus on prevention via patching. User education about avoiding untrusted websites reduces attack surface. If available, enable Chrome sandbox enforcement and disable unnecessary extensions to reduce side-channel surface.

Why prioritize this

Although rated Medium severity with no active KEV listing, this vulnerability warrants prompt patching because it directly enables privacy violations with low barrier to exploitation. Chrome's ease of patching (automatic updates) and the absence of known in-the-wild attacks mean organizations can remediate quickly without operational friction. Delayed patching unnecessarily exposes users to cross-origin data leakage; the speed of patch deployment should exceed the complexity of prioritization in this case.

Risk score, explained

The CVSS 6.5 score reflects high confidentiality impact (remote attacker can read cross-origin data) balanced against the requirement for user interaction and lack of integrity/availability consequences. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates network attack surface, low complexity, no privilege requirement, required user interaction, unchanged scope, and high confidential risk. Absence from the KEV catalog suggests no evidence of weaponization to date, but the ease of patch deployment argues for near-immediate remediation regardless.

Frequently asked questions