CVE-2026-11284 Overview
CVE-2026-11284 is a side-channel information leakage vulnerability in the PerformanceAPIs component of Google Chrome prior to version 149.0.7827.53. A remote attacker can craft an HTML page that abuses timing or observable side-effects in the Performance APIs to leak cross-origin data. Exploitation requires the victim to load attacker-controlled content, satisfying the user interaction requirement reflected in the CVSS vector. The issue is tracked under [CWE-1300] (improper protection of physical side channels) and [CWE-203] (observable discrepancy). Chromium rates the internal security severity as Low, while the NVD scoring places it in the medium range due to the high confidentiality impact on cross-origin data.
Critical Impact
A remote attacker can exfiltrate cross-origin data from a victim's browser by serving a crafted HTML page that abuses Performance APIs as a side channel.
Affected Products
- Google Chrome versions prior to 149.0.7827.53
- Chromium-based browsers on Apple macOS, Microsoft Windows, and Linux
- Web applications relying on same-origin isolation guarantees when rendered in vulnerable Chrome builds
Discovery Timeline
- 2026-06-05 - CVE-2026-11284 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11284
Vulnerability Analysis
The flaw resides in Chrome's implementation of the Web Performance APIs, which expose high-resolution timing and resource metadata to JavaScript. The browser fails to fully isolate observable measurements between origins, allowing an attacker page to infer attributes of cross-origin responses. This class of issue is categorized as a side-channel [CWE-1300] and observable-discrepancy [CWE-203] weakness. The information leakage breaks the same-origin policy guarantees that web applications rely on for confidentiality of authenticated content. Successful exploitation does not require credentials or local access, but it does require the victim to load the malicious page.
Root Cause
The root cause is insufficient masking of timing or resource metadata returned by Performance APIs when those APIs interact with cross-origin resources. Differences in measurable behavior — for example, how long a sub-resource takes to load or process — correlate with the content or state of the cross-origin response. An attacker can repeatedly trigger these measurements and statistically recover bits of cross-origin data.
Attack Vector
The attack vector is network-based and requires user interaction, typically the victim visiting an attacker-controlled site or a third-party site embedding attacker JavaScript. The exploit operates entirely in client-side script using standard performance interfaces such as performance.now(), PerformanceObserver, and performance.getEntriesByType(). No memory corruption is required. Refer to the Chromium Issue Report #502073069 and the Google Chrome Desktop Update advisory for additional context. No public proof-of-concept code is available, and no verified exploitation samples have been released.
Detection Methods for CVE-2026-11284
Indicators of Compromise
- Browser telemetry showing Chrome desktop versions older than 149.0.7827.53 actively rendering untrusted content.
- Web traffic to recently registered or low-reputation domains that serve JavaScript invoking PerformanceObserver or repeated performance.now() measurements against cross-origin resources.
- Anomalous client-side script patterns that issue large volumes of sub-resource fetches followed by precise timing reads.
Detection Strategies
- Inventory Chrome and Chromium-based browser versions across managed endpoints and flag any build below 149.0.7827.53.
- Inspect proxy and DNS logs for outbound connections to pages that combine cross-origin embeds with high-frequency Performance API usage.
- Correlate browser version data with web gateway logs to identify users on vulnerable builds visiting untrusted sites.
Monitoring Recommendations
- Continuously track browser version compliance through endpoint management tooling.
- Monitor for newly observed JavaScript payloads that pair iframe or link cross-origin loads with performance.getEntries() analysis.
- Alert on user reports of unexpected session data exposure on web applications that handle sensitive cross-origin content.
How to Mitigate CVE-2026-11284
Immediate Actions Required
- Update Google Chrome to version 149.0.7827.53 or later on Windows, macOS, and Linux endpoints.
- Force-restart Chrome processes after deployment to ensure the patched binary is loaded by all browser sessions.
- Audit Chromium-based browsers such as Microsoft Edge and Brave for vendor updates that incorporate the upstream Chromium fix.
Patch Information
Google released the fix in the Stable channel desktop update documented in the Google Chrome Desktop Update advisory. The corresponding Chromium tracker entry is Chromium Issue Report #502073069. Administrators should deploy Chrome 149.0.7827.53 or later through their standard browser management workflow.
Workarounds
- Restrict browsing to trusted sites using web content filtering until patched builds are deployed across the fleet.
- Enforce Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers on sensitive web applications to reduce cross-origin observability.
- Disable third-party iframe embedding on high-value internal applications where feasible.
# Configuration example: enforce minimum Chrome version via enterprise policy (Windows)
# HKLM\SOFTWARE\Policies\Google\Chrome\TargetVersionPrefix = "149.0.7827.53"
# Cross-origin isolation response headers for sensitive web apps:
# Cross-Origin-Opener-Policy: same-origin
# Cross-Origin-Embedder-Policy: require-corp
# Cross-Origin-Resource-Policy: same-origin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
