CVE-2026-78955: Google Chrome PerformanceAPIs XSS Vulnerability

CVE-2026-78955 Overview

CVE-2026-78955 is an observable discrepancy vulnerability in the Performance APIs of Google Chrome prior to version 152.0.7977.65. A remote attacker can potentially obtain cross-origin data by serving a crafted HTML page to a victim browser. Chromium rates the security severity as Medium. The weakness is classified under CWE-203: Observable Discrepancy, a side-channel class where behavioral differences leak information across security boundaries. The flaw undermines the browser's same-origin policy, one of the foundational isolation guarantees of the web platform.

Critical Impact
A remote attacker can bypass the same-origin policy through timing or state observations exposed by Performance APIs, leaking cross-origin data from a user browsing a malicious page.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that inherit the affected Performance APIs implementation
Downstream Chromium forks tracking the Stable channel before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-78955 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78955

Vulnerability Analysis

The vulnerability resides in Chrome's Performance APIs, the browser interfaces that expose timing and resource-loading measurements to web pages. An observable discrepancy [CWE-203] occurs when two code paths produce measurably different behavior depending on a value that should remain confidential. In this case, attacker-controlled JavaScript on one origin can observe timing or metric differences that reveal information about resources loaded from another origin. This class of flaw effectively creates a side channel that circumvents the same-origin policy without requiring memory corruption or code execution. The result is a controlled cross-origin information leak driven purely by observation of legitimate API outputs.

Root Cause

The root cause is insufficient normalization of measurements returned by Performance APIs when cross-origin resources are involved. According to the Chromium issue tracker entry and the Google Chrome Stable Update advisory, values exposed to script differed in ways that depend on cross-origin state. Because the same-origin policy relies on uniform, non-distinguishing responses for opaque cross-origin resources, any observable variance reintroduces a leakage channel.

Attack Vector

Exploitation requires a victim to load a crafted HTML page under attacker control. The page executes JavaScript that repeatedly queries Performance API entries, correlates measured discrepancies with cross-origin content, and infers protected data. No authentication, prompt, or user interaction beyond visiting the page is needed. The attack is network-reachable through any web delivery vector including phishing links, malicious advertisements, or compromised sites.

No verified public exploit code is available. See the Chromium issue tracker for technical details as access is opened.

Detection Methods for CVE-2026-78955

Indicators of Compromise

Browser process telemetry showing Chrome versions earlier than 152.0.7977.65 still running after the August 2026 Stable update
Web traffic to unfamiliar domains hosting pages that issue high-frequency performance.getEntries() or PerformanceObserver calls
JavaScript execution patterns that repeatedly load cross-origin subresources followed by tight timing measurement loops

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build lower than 152.0.7977.65.
Monitor endpoint process telemetry for chrome.exe version strings and correlate with browsing telemetry from proxy or DNS logs.
Deploy content security policies and referrer controls that reduce the value of any cross-origin data an attacker could infer.

Monitoring Recommendations

Ingest browser version data into your SIEM and alert on outdated Chromium builds after the vendor patch date.
Track outbound connections to newly registered domains serving HTML that references sensitive internal origins.
Baseline normal Performance API usage on high-value web applications to spot anomalous script behavior against them.

How to Mitigate CVE-2026-78955

Immediate Actions Required

Update Google Chrome for Desktop to version 152.0.7977.65 or later on all managed endpoints.
Force-restart browser sessions after deployment so the patched binary is loaded into memory.
Verify that Chromium-based derivative browsers have absorbed the upstream fix before considering the environment remediated.

Patch Information

Google released the fix in the Chrome Stable channel update announced on 2026-08-25. Refer to the Google Chrome Stable Update advisory for the full changelog and to the Chromium Issue Tracker #514439436 for the bug record. Enterprises using managed Chrome deployments should validate that Update-Policy settings permit installation of 152.0.7977.65 and that offline endpoints are covered by an update fallback plan.

Workarounds

Enforce automatic browser updates via Chrome Enterprise policy or an equivalent mobile device management profile.
Restrict browsing on sensitive systems to allowlisted domains until the patched version is confirmed installed.
Apply strict Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers on internal web applications to limit cross-origin observation surface.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version