This vulnerability involves side-channel information leakage through the PerformanceAPIs in Google Chrome versions before 149.0.7827.53. An attacker can exploit this by crafting a malicious HTML page that leaks cross-origin data, potentially exposing sensitive information from other origins. The issue is categorized under CWE-1300 (Information Leak Through Side Channel) and CWE-203 (Information Exposure Through Discrepancy). The CVSS vector indicates the attack is network-based, requires no privileges, but requires user interaction, and impacts confidentiality with high impact but no integrity or availability impact.

The vulnerability allows an attacker to leak confidential cross-origin data via a side-channel attack using the PerformanceAPIs. This could lead to unauthorized disclosure of sensitive information from other web origins when a user visits a malicious page. There is no impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since no explicit patch or remediation level is stated, users and administrators should monitor the vendor advisory for updates and apply any forthcoming official fixes promptly.