Google Chrome CVE-2026-78955

Exploitation requires a victim running Chrome prior to 152.0.7977.65 to visit an attacker-controlled web page - user interaction (UI:R) is mandatory, ruling out fully automated network-level exploitation. The attacker must be able to serve arbitrary JavaScript capable of invoking Performance API methods and observing the resulting discrepancies. For meaningful data exfiltration, the victim must have an active session or data at the target cross-origin site; without a cross-origin target with sensitive data, the leakage has no practical value. No attacker authentication is required (PR:N per CVSS). No special browser configuration or feature flag is cited in available data as a prerequisite - the flaw exists in the default PerformanceAPIs implementation. The primary limiting factors are: mandatory user interaction, dependency on victim having a valuable cross-origin session, and the probabilistic nature of timing-based side-channel attacks which may require multiple measurements to achieve reliable data inference.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting a network-accessible, low-complexity attack requiring only that the victim visit a malicious page - no attacker authentication needed. The high confidentiality impact (C:H) signals meaningful cross-origin data exposure potential. However, EPSS at 0.37% (30th percentile) is notably low for a C:H flaw, suggesting the security community currently assesses exploitation as unlikely in the short term. There is no KEV listing and no public POC identified. The required user interaction (UI:R) limits mass automated exploitation, making targeted phishing scenarios more realistic than broad drive-by campaigns. Overall, this is a genuine medium-priority issue for organizations deploying Chrome at scale: high potential impact if exploited against users with sensitive sessions, but low current exploitation probability. The Chromium severity classification of 'Medium' aligns with EPSS and KEV signals rather than the CVSS C:H metric alone.

An attacker hosts a crafted HTML page containing JavaScript that systematically calls Performance API methods while loading cross-origin resources, measuring observable timing or behavioral discrepancies in the API responses. When a victim with an active session on a target origin (e.g., a banking or corporate web application) visits the attacker-controlled page, the JavaScript correlates discrepancy patterns to infer sensitive cross-origin data - such as authentication state, response content characteristics, or resource existence. No public exploit code has been identified at time of analysis, and the attack requires the victim to be socially engineered into visiting the malicious page.