Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data… (CVE-2026-78955)

CVE-2026-78955 describes a security flaw in Google Chrome's Performance APIs where observable discrepancies could be exploited by a remote attacker to access cross-origin data. This vulnerability affects versions of Chrome before 152.0.7977.65. The flaw is categorized under CWE-203 (Information Exposure Through Discrepancy). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to confidentiality. There are no known exploits in the wild and no explicit vendor advisory or patch link provided in the data.

The vulnerability allows a remote attacker to potentially obtain sensitive cross-origin data by exploiting discrepancies in Performance APIs. This could lead to unauthorized information disclosure without impacting integrity or availability. The medium severity reflects the confidentiality impact and the requirement for user interaction.

A fixed version is available at 152.0.7977.65; users should upgrade to this version or later to remediate the vulnerability. Since no vendor advisory or patch link is provided, confirm patch availability from official Google Chrome security advisories. No additional mitigation steps are indicated.