CVE-2026-13935: Chrome Information Disclosure Vulnerability

CVE-2026-13935 Overview

CVE-2026-13935 is a side-channel information leakage vulnerability in the ComputePressure API implementation in Google Chrome versions prior to 150.0.7871.47. A remote attacker can leak cross-origin data by luring a user to a crafted HTML page. The flaw is categorized under [CWE-1300] (Improper Protection of Physical Side Channels) and results in disclosure of information that should remain isolated by the browser's same-origin policy. Google's Chromium project rates the internal severity as Medium.

Critical Impact
Remote attackers can extract cross-origin data from a victim's browser session by hosting a malicious page that abuses the Compute Pressure API.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers sharing the affected ComputePressure implementation
Desktop Chrome Stable channel installations

Discovery Timeline

2026-06-30 - CVE-2026-13935 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13935

Vulnerability Analysis

The vulnerability resides in Chrome's Compute Pressure API, a Web API that exposes CPU pressure states to JavaScript so applications can adapt workload behavior. The implementation exposes measurable timing or state signals that vary based on activity in other browsing contexts. An attacker-controlled page can observe these pressure signals and infer information about workloads running in cross-origin frames, tabs, or documents. This breaks the browser's cross-origin isolation guarantee even though the target origin never returns data directly to the attacker.

Exploitation requires the victim to visit a crafted HTML page, which is consistent with the CVSS user interaction requirement. No privileges are needed on the target system, and the attack executes purely within the browser sandbox. Successful exploitation yields confidentiality impact without modifying data or affecting availability.

Root Cause

The root cause is insufficient isolation of shared hardware-derived signals surfaced through the Compute Pressure API. Because pressure telemetry reflects global system state, a script in one origin can correlate observed pressure transitions with the activity of another origin. This is a classic physical side channel promoted into the JavaScript layer through insufficiently coarse or insufficiently isolated telemetry.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page that subscribes to PressureObserver events, executes controlled workloads, and statistically analyzes pressure state changes over time. Correlating those changes with predicted victim-side operations lets the attacker infer secrets such as user activity patterns, cross-origin resource states, or workload fingerprints. No verified public proof-of-concept is available at the time of publication. Technical detail is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13935

Indicators of Compromise

Browser telemetry showing pages instantiating PressureObserver alongside high-frequency workload generation in worker threads
Outbound connections to attacker-controlled domains immediately after pressure-observation windows
Chrome process versions below 150.0.7871.47 reported by endpoint inventory

Detection Strategies

Inventory installed Chrome builds through endpoint management and flag versions below 150.0.7871.47
Inspect proxy or DNS logs for repeated visits to unclassified domains that serve JavaScript invoking the Compute Pressure API
Correlate browser process CPU spikes with navigation events to identify pages executing sustained pressure-inducing workloads

Monitoring Recommendations

Enable browser version reporting through Chrome Enterprise policies and forward telemetry to a central log platform
Alert on Chrome installations that fall behind the current Stable channel release for more than seven days
Monitor web filtering logs for HTML content referencing PressureObserver from low-reputation origins

How to Mitigate CVE-2026-13935

Immediate Actions Required

Update Google Chrome to 150.0.7871.47 or later on all managed endpoints
Force-restart Chrome after policy-driven updates to ensure the patched binary is loaded
Restrict browsing to trusted origins for privileged workstations until patching completes

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update advisory. Administrators should deploy version 150.0.7871.47 or later. Chromium-based browsers should be updated once downstream vendors incorporate the upstream fix.

Workarounds

Disable the Compute Pressure API via enterprise policy where supported until patched builds are deployed
Apply web filtering to block untrusted HTML content on high-value endpoints
Enforce site isolation and strict cross-origin policies through Chrome Enterprise configuration

bash

# Configuration example: force Chrome auto-update on Windows via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v Update /t REG_DWORD /d 1 /f