What is the CVSS score of CVE-2026-13935?

CVE-2026-13935 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13935?

Yes, a patch is available for CVE-2026-13935. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13935

EUVD-2026-40621 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-06-30 chrome-cve-admin@google.com

GHSA-q44w-4f8h-gq98

Information Disclosure Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page, no auth required, but user must visit; cross-origin confidentiality leak only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:49 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Side-channel information leakage in ComputePressure in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage via the ComputePressure API in Google Chrome prior to 150.0.7871.47 enables remote attackers to read cross-origin data by inducing a victim to visit a crafted HTML page. The vulnerability exploits physical or logical resource-pressure side channels exposed through the ComputePressure browser API, violating the same-origin policy's confidentiality guarantees. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) corroborates the low near-term exploitation probability despite the high confidentiality impact rating.

Technical ContextAI

ComputePressure is a W3C incubated Web API that surfaces CPU and system thermal/performance pressure signals to JavaScript running in the browser, enabling adaptive content rendering. CWE-1300 (Improper Protection of Physical Side Channels) describes the root cause class: the API inadvertently exposes timing or resource-state observations granular enough for an attacker-controlled origin to infer the state of resources belonging to a victim cross-origin context - a classic same-origin policy bypass via hardware-level observable side channels. The affected component is Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) across all platform variants, as no platform qualifier appears in the CPE string. The Suse tag in intelligence data suggests downstream Linux distribution packages (e.g., openSUSE Chromium packages) are also in scope.

RemediationAI

The primary remediation is upgrading Google Chrome to version 150.0.7871.47 or later, which is confirmed as the patched stable channel release per the Google Chrome Releases blog advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this update automatically for most desktop users; administrators managing enterprise deployments should verify the installed version via chrome://settings/help or group policy reporting and force-update if auto-update is suppressed. For environments where immediate patching is not possible, restricting access to untrusted or external web content via enterprise browser policies or network-level filtering reduces exposure, though these controls may have significant usability trade-offs. openSUSE and other Linux distribution maintainers should apply the corresponding Chromium package update when available through distribution channels. No workaround is known that disables the ComputePressure API in pre-patch Chrome versions without third-party tooling.