CVE-2026-13935: Chrome ComputePressure Side-Channel Information Leakage (CVSS 6.5)

Technical summary

This vulnerability exploits improper isolation in Chrome's ComputePressure implementation, a performance API that reports CPU and memory pressure states. The side-channel attack leverages timing variations or observable state changes to infer information about concurrent processes or cross-origin activity. The vulnerability is classified as CWE-1300 (Information Exposure Through Physical Means), indicating that physical or behavioral characteristics of the system can be observed and correlated to extract confidential data. The attack surface is network-based with low complexity; no user interaction beyond visiting a page is strictly required, though the CVSS vector indicates UI interaction (clicking, navigation) is part of the attack chain. The lack of authentication or elevated privileges needed strengthens the practical attack likelihood.

Business impact

Organizations face confidential data exposure risk if employees or customers use affected Chrome versions to visit untrusted sites. Potential leaked information could include indicators of internal processes, deployment patterns, or infrastructure load—valuable for reconnaissance before targeted attacks. While not immediately enabling account takeover or system compromise, the information gain supports follow-on attacks (privilege escalation, lateral movement planning). For vendors building services on ComputePressure, the vulnerability may undermine trust in the API's isolation guarantees and prompt feature redesign or deprecation discussions.

Affected systems

The vulnerability affects Google Chrome browsers prior to version 150.0.7871.47. This includes all Chrome deployments on Windows, macOS, Linux, Android, and iOS running earlier versions. Users of Chromium-based browsers (Edge, Opera, Brave) may also be affected if they have not yet received corresponding patches in their release cycles. No server-side systems are directly affected; the attack originates from client-side browser behavior.

Exploitability

Exploitation requires only network access and the ability to host or inject a malicious HTML page into a user's browsing session. No special browser configuration, extensions, or user software is required. The attack succeeds on any unpatched version below 150.0.7871.47. However, successful data extraction likely requires either repeated observations, statistical analysis of timing measurements, or knowledge of expected system states to correlate against observed pressure signals. This raises the bar for casual exploitation but remains within reach of skilled attackers. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, suggesting either recent discovery or limited active exploitation in the wild.

Remediation

Users must update Chrome to version 150.0.7871.47 or later. Google typically rolls out updates automatically, but users should verify completion via Chrome Settings > About > Google Chrome. Organizations managing Chrome instances should verify deployment of the patched version across all endpoints. No workaround exists; patching is the only mitigation. Consider increasing monitoring of user browsing activity or restricting access to high-risk sites if immediate patching is delayed.

Patch guidance

Update to Chrome 150.0.7871.47 or any subsequent release. Verify the update by navigating to chrome://settings/help, which displays the installed version and triggers an automatic check for newer releases. For enterprise deployments, use Google's Chrome policy templates to enforce minimum version requirements (MinimumChromeVersion). Staggered rollout is acceptable given the vulnerability's moderate severity, but all instances should reach the patched version within 30 days of release. Monitor Chrome update status via Google Admin Console or third-party endpoint management tools.

Detection guidance

Detection is primarily behavioral. Monitor for unusual patterns of browser resource pressure queries (ComputePressure API calls) from suspicious origins or domains known for exploitation. Correlate timing of API calls with cross-origin navigation or unexpected JavaScript execution. Network-based detection is limited; the attack manifests as normal HTTPS traffic. Consider deploying Content Security Policy (CSP) headers to restrict script execution origins and reduce the attack surface. Browser telemetry and crash reports may reveal exploitation attempts; review Chrome crash logs for related errors. User reports of unexplained slowdowns or unexpected data leaks should prompt browser version audits.

Why prioritize this

This vulnerability merits prompt but non-emergency patching. The CVSS score of 6.5 reflects moderate risk: network accessibility, low attack complexity, and high confidentiality impact are offset by the lack of integrity or availability effects and the requirement for user interaction. No critical data systems are directly at risk, but information leakage can accelerate subsequent attacks. Organizations should prioritize patching endpoints whose users regularly visit untrusted or high-risk sites (research, open-source communities, forums). Workstations of security analysts, developers, and IT staff are secondary priorities. Remote workers and BYOD devices should be addressed within 30–45 days.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: (1) Network vector (AV:N) – the flaw is remotely exploitable via a webpage; (2) Low attack complexity (AC:L) – no special browser configuration or race conditions are required; (3) No privileges required (PR:N) – standard user context suffices; (4) User interaction needed (UI:R) – the user must navigate to or remain on the attacker's page; (5) Unchanged scope (S:U) – the attack does not cross privilege boundaries; (6) High confidentiality impact (C:H) – information leakage is substantial; (7) No integrity or availability impact (I:N, A:N) – data cannot be modified and service is not disrupted. The score appropriately balances the ease of exploitation against the limited scope of harm.

Frequently asked questions