CVE-2026-13952 describes a medium severity vulnerability in Google Chrome affecting versions before 150.0.7871.47. The vulnerability stems from an inappropriate implementation in the PerformanceAPIs, which can be exploited by a remote attacker through a specially crafted HTML page to leak cross-origin data. This compromises the same-origin policy protections by allowing data leakage across origins. The vulnerability was publicly disclosed with no CVSS score assigned. The vendor has published an advisory indicating a stable channel update addressing this issue in version 150.0.7871.47.

The vulnerability allows a remote attacker to bypass same-origin policy restrictions and leak data from other origins via the PerformanceAPIs. This could lead to unauthorized disclosure of sensitive information accessible in the browser context. There are no known exploits in the wild at the time of disclosure.

Users should update Google Chrome to version 150.0.7871.47 or later, where this vulnerability has been addressed. Since this is a client-side browser vulnerability, applying the official update is the recommended and effective mitigation. Patch status is confirmed by the vendor advisory linked to the stable channel update.