Google Chrome CVE-2026-13922

Exploitation requires a victim user to actively visit an attacker-controlled HTML page in an unpatched version of Google Chrome (prior to 150.0.7871.47) on a desktop platform. The CVSS vector confirms user interaction is required (UI:R) and that no attacker authentication or privileges are needed (PR:N). Impact is strictly limited to cross-origin confidentiality leakage - no code execution, no write capability, and no availability disruption. Exploitation is further constrained by the passive, observational nature of side-channel attacks, which typically require careful calibration to a target's rendering behavior. No special browser configuration, feature flag, or non-default setting is referenced as a prerequisite. The key limiting factors are the UI:R gate (victim must visit the page) and the absence of any integrity or availability vector.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a high confidentiality impact accessible over the network with no attacker privileges, but critically gated by required user interaction. The EPSS score of 0.21% (11th percentile) signals very low near-term exploitation probability, aligning with the absence of this CVE from CISA KEV and the lack of any referenced public exploit code. The High confidentiality rating is technically accurate - cross-origin data leakage can expose session tokens, private page content, or authentication state - but real-world exploitation requires both a willing victim to visit an attacker-controlled page AND a precise side-channel implementation, making mass exploitation unlikely. There is no integrity or availability impact. Risk is elevated specifically for users routinely accessing sensitive cross-origin resources (corporate intranets, banking portals) in the same browser session as untrusted web content. For most environments, this is a routine patch-cycle priority rather than an emergency response item.

An attacker hosts a crafted HTML page that embeds or references cross-origin resources and uses JavaScript to observe timing or state variations in Chrome's Paint rendering subsystem while those resources are rendered. When a victim visits this page in an unpatched Chrome browser, the side-channel allows the attacker script to infer pixel-level or structural content belonging to a different origin - potentially including session-authenticated pages loaded in adjacent tabs or frames. No public exploit code has been identified at time of analysis, and the attack requires active victim participation.