CVE-2026-13952: Chrome PerformanceAPIs Cross-Origin Data Leak (Medium Severity)

Technical summary

CVE-2026-13952 stems from inappropriate implementation in Chrome's PerformanceAPIs, enabling cross-origin data leakage through a crafted HTML page. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), though the manifestation here is more specifically a cross-origin information disclosure. The attack surface is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges but user interaction (UI:R). The impact is limited to confidentiality of cross-origin data; integrity and availability are not affected. Chromium security assessment: Medium severity.

Business impact

While the CVSS score is relatively modest at 4.3, the practical risk should not be underestimated. Attackers could exfiltrate session tokens, CSRF tokens, API keys, or other sensitive cross-origin content that a logged-in user possesses. For organizations where employees access sensitive cloud applications, banking platforms, or internal dashboards, this vulnerability creates a vector for credential theft or unauthorized data access. The requirement for user interaction (visiting a malicious site) limits mass exploitation but remains a credible phishing or watering-hole attack scenario.

Affected systems

Google Chrome releases prior to version 150.0.7871.47 are affected. This includes stable, beta, and extended-release channels on Windows, macOS, Linux, Android, and iOS. Organizations standardizing on Chrome for employee access should prioritize confirmation that all deployed instances have been updated to 150.0.7871.47 or later.

Exploitability

Exploitation is straightforward in technical terms: an attacker hosts a malicious webpage, tricks or waits for a user to visit it, and the PerformanceAPIs flaw permits reading cross-origin data without the victim's explicit knowledge. No sophisticated techniques, exploit kit integration, or zero-day chain is required. However, real-world exploitation depends on social engineering or compromised distribution channels to drive traffic to the attack page. As of the published date (2026-06-30), this vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, though the low barrier to exploitation suggests monitoring is warranted.

Remediation

Update Google Chrome to version 150.0.7871.47 or any subsequent release. Organizations with managed Chrome deployments should trigger automatic updates or use group policy (on Windows) and configuration management to enforce the patch. For personal devices, users should enable automatic updates and restart their browser. Verify the installed version via Chrome menu > About Google Chrome, which will also show whether the update has been applied and the browser restarted.

Patch guidance

Google released the fix in Chrome 150.0.7871.47. Check your current version under Settings > About > Google Chrome (it auto-checks for updates). If your installed version is 150.0.7871.47 or higher, you are protected. If your version number is lower, click 'Update' and restart the browser. Enterprise administrators should confirm patch deployment via Chrome management console or device management tools within 5–7 days of publication.

Detection guidance

Network-level detection is difficult because the attack occurs within the browser's PerformanceAPIs and does not generate abnormal network traffic signatures. Endpoint detection should focus on Chrome process version auditing—ensure all Chrome instances report version 150.0.7871.47 or later. User-awareness training remains important: advise employees to avoid visiting untrusted or unexpected links, particularly from unfamiliar senders. Monitor for anomalous cross-origin requests in web application logs if your environment has sophisticated session telemetry.

Why prioritize this

Although the CVSS score is moderate (4.3), prioritize patching because: (1) exploitation requires no special privileges or technical complexity, (2) the attack vector is network-facing and user-initiated phishing is a common delivery method, and (3) the leaked data—tokens, cookies, credentials—can have severe downstream consequences. This is a low-friction attack that should be remediated quickly to reduce window of exposure.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the attack vector (network), low complexity, no privileges required, but the necessity of user interaction and limited scope (confidentiality only, no integrity or availability impact). While the numerical score is medium-range, the real-world risk is amplified by how easily an attacker can craft the exploit and by the sensitive nature of cross-origin data that may be leaked. Security teams should not anchor decisions on the CVSS score alone; contextualize it within your threat model and the sensitivity of data users access.

Frequently asked questions