Google Chrome CVE-2026-11284

Exploitation requires the victim to visit an attacker-controlled HTML page that executes malicious JavaScript (CVSS UI:R - user interaction is mandatory). The JavaScript must invoke Chrome Performance API methods in a context where cross-origin resources are loaded by the same browser session, so the victim must have an active session or browsable relationship to a target origin. No authentication to Chrome or the attacked service is required from the attacker's perspective (PR:N). Limiting factors include: (1) Chrome's default timer precision reduction mitigations (introduced post-Spectre), which add jitter to high-resolution timers and may reduce measurement reliability; (2) Site Isolation, enabled by default, which separates cross-origin processes and constrains the data an attacker can directly observe; (3) the need for the victim to be browsing a target origin during or near the attack window. Chromium's own 'Low' internal severity rating strongly implies that one or more of these mitigations already meaningfully reduces exploit reliability against up-to-date default Chrome configurations.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a Medium score of 6.5, driven by the High confidentiality impact. However, multiple signals collectively reduce real-world priority. First, user interaction is required (UI:R) - the victim must actively visit an attacker-controlled page. Second, Chromium's internal severity rating of 'Low' directly contradicts the NVD Medium rating; this discrepancy likely reflects Google's engineering assessment that reliable, high-confidence exploitation of this specific timing channel is non-trivial in practice. Third, EPSS is 0.03% (11th percentile), placing this well below the threshold of actively targeted vulnerabilities. Fourth, this CVE is NOT listed in CISA KEV, and no public exploit code has been identified. The scope is Unchanged (S:U), meaning a successful exploit does not elevate the attacker into a broader system context. Taken together, this vulnerability is a theoretical privacy concern - particularly relevant for high-value targets where cross-origin data inference matters - but is not an immediate high-priority patch for most enterprise environments absent active exploitation evidence.

An attacker creates a malicious HTML page containing JavaScript that exploits Chrome's Performance APIs to repeatedly measure the timing of cross-origin resource fetch operations - for example, inferring whether a victim is authenticated to a target site by observing load-time differences for authenticated versus unauthenticated responses. The victim is directed to the page via a phishing link or malicious advertisement, and the timing measurements are exfiltrated to the attacker's server, revealing cross-origin state without any direct access violation. No public exploit code exists at the time of analysis, and the side-channel technique requires consistent, precise timing conditions that may be disrupted by system load or existing browser mitigations.