What is the CVSS score of CVE-2026-13952?

CVE-2026-13952 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13952?

Yes, a patch is available for CVE-2026-13952. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13952

EUVD-2026-40640 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-30 chrome-cve-admin@google.com

GHSA-w89m-8ch9-hcx6

Google CSRF Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.7 MEDIUM

S:C assessed over vendor's S:U because cross-origin data leakage inherently breaches a separate security scope (another origin); other metrics match the provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 22:32 vuln.today

CVSS changed

Jul 01, 2026 - 20:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.

Technical ContextAI

The Performance API (window.performance, PerformanceObserver, PerformanceMark/Measure) is a W3C browser API that exposes high-resolution timing data to JavaScript. An 'inappropriate implementation' in Chromium's handling of these APIs creates a timing side-channel: a crafted page can issue cross-origin resource requests and measure fine-grained timing deltas via PerformanceResourceTiming entries or similar hooks, allowing inference about the content or state of resources from another origin. This class of flaw is rooted in CWE-352 as tagged, though the description's cross-origin data-leak pattern more precisely resembles a CWE-203 (Observable Timing Discrepancy) or CWE-359 side-channel - the CSRF/CWE-352 tag may indicate the mechanism by which cross-origin requests are triggered as part of the measurement. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 150.0.7871.47.

RemediationAI

Update Google Chrome to stable channel version 150.0.7871.47 or later, which contains the vendor-released patch for this issue. The advisory is published at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism should apply this patch automatically for most managed and consumer deployments; administrators should verify fleet compliance via endpoint management tooling. As a temporary compensating control pending patching, browser-based mitigations such as enabling Site Isolation (--site-per-process, enabled by default in modern Chrome) may reduce the cross-origin data accessible via timing side-channels, though this does not fully remediate the flaw. Reducing PerformanceObserver and PerformanceResourceTiming API surface via enterprise policy is not straightforward without breaking legitimate web application performance tooling.