Google Chrome CVE-2026-13790

User interaction is required: the victim must visit an attacker-controlled HTML page in an affected Chrome version (prior to 150.0.7871.47). No authentication, elevated privileges, or special server-side configuration is needed on the attacker side. The attack is limited by the need for a single user interaction (UI:R in CVSS) and by the SSVC assessment that it is not automatable, indicating that reliable exploitation likely requires environmental tuning (e.g., controlled timing, specific page structure) rather than a fire-and-forget payload. Exploitation is further constrained to desktop Chrome; mobile channel applicability is unconfirmed from available data.

The NVD CVSS 3.1 score of 6.5 (Medium) reflects a network-reachable, low-complexity attack requiring only one user interaction, with High confidentiality impact and no integrity or availability impact. However, several signals dampen the urgency: EPSS is only 0.21% (11th percentile), indicating historically low exploitation probability at time of scoring; SSVC classifies exploitation as 'none', automatable as 'no', and technical impact as 'partial'. No CISA KEV listing exists. The gap between the High confidentiality impact (cross-origin data) and the low EPSS/SSVC signals is consistent with a vulnerability that is technically impactful but difficult to reliably weaponize in the wild - side-channel attacks of this class typically require careful timing and controlled conditions. The S:U scope designation in the provided CVSS vector is worth scrutiny: cross-origin leakage conceptually crosses security boundaries, which would argue for S:C; the NVD choice of S:U with C:H may be treating the browser as the single vulnerable component and attributing the confidentiality loss entirely within that component's scope. This ambiguity should be noted by defenders evaluating CVSS-based prioritization.

An attacker hosts a crafted HTML page that embeds or references a cross-origin resource and then manipulates scroll behavior to infer properties of that resource through observable side-channel differences in the browser's rendering engine. The victim is social-engineered into visiting the attacker's page, after which the attacker's JavaScript silently exfiltrates cross-origin data (e.g., authenticated page content, sensitive URL fragments) back to the attacker-controlled server. No public exploit code has been identified at time of analysis.