Google Chrome CVE-2026-13935

The victim must actively visit an attacker-controlled HTML page in a vulnerable Chrome browser (UI:R); drive-by exploitation via a network position alone is insufficient. No authentication to Chrome or any service is required from the attacker's perspective (PR:N). The ComputePressure API must be available in the browser context - it is a default-enabled incubated API in Chrome and does not require a non-default flag. The attack is constrained by the signal-to-noise ratio of the side channel, which varies by host hardware, OS scheduler behavior, and system load, making reliable exploitation environment-dependent and non-automatable (SSVC: Automatable: no). Cross-origin data inference is limited in scope to what can be observed through pressure signals, not arbitrary memory reads. Exploitation is further limited to desktop Chrome; mobile Chrome or Chromium-based browsers with different API surface exposure may behave differently, though this is not confirmed from available data.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity flaw requiring no authentication but needing user interaction - the victim must visit an attacker-controlled page. C:H signals that the confidentiality impact is high if exploited, but S:U and no integrity or availability impact cap the overall severity. Critically, EPSS at 0.21% (11th percentile) indicates very low real-world exploitation probability relative to other CVEs, and the SSVC assessment confirms Exploitation: none, Automatable: no, and Technical Impact: partial - a profile consistent with a difficult-to-reliably-exploit side channel rather than a straightforward memory corruption. The UI:R requirement further limits automatable mass exploitation. CISA KEV does not list this CVE, and no POC has been identified. The real-world risk is best characterized as low-to-moderate: the C:H CVSS component is a ceiling under optimal attacker conditions, not a reflection of likely outcomes for most deployments. Security teams can reasonably de-prioritize this relative to exploited or automatable network flaws while still patching promptly given Chrome's auto-update posture.

An attacker hosts a crafted HTML page that leverages the ComputePressure JavaScript API to repeatedly sample CPU or thermal pressure states at high frequency while simultaneously triggering cross-origin resource loads (e.g., images or iframes from a target origin). By correlating pressure fluctuations with load timing, the attacker's script infers cross-origin state - such as whether the target page loaded specific authenticated resources - and exfiltrates inferred data to an attacker-controlled server. The attack requires the victim to navigate to or be redirected to the attacker's page, and reliability of the side-channel inference is likely environment- and hardware-dependent.