Google pushed an emergency stable channel update this week to crush a side-channel vulnerability in the Compute Pressure API that let remote attackers silently steal cross-origin data on Windows and Mac. The fix, tucked into Chrome 150.0.7871.47, patches CVE-2026-13935—a flaw rated High severity that abused the same browser plumbing used to monitor CPU load as an observation covert channel.

Security engineers at Google’s Chrome team disclosed that the bug was exploitable through a crafted HTML page, meaning a user simply visiting a malicious link could have allowed an attacker to read sensitive information from other origins. The attack required no user interaction beyond opening the page, making it particularly dangerous for any logged-in web apps or internal dashboards accessible from the same browser session.

With the update now rolling out to Windows and Mac systems (Linux and ChromeOS builds are unaffected because the vulnerable API surface is not exposed there), the clock is ticking for users and IT administrators to apply the patch before exploit code becomes public.

The vulnerability: How Compute Pressure turned into a stealth channel

The Compute Pressure API is a relatively new web standard that helps websites respond to device performance. By exposing real-time CPU utilization, core frequencies, and thermal states, it allows apps like video editors or conferencing tools to degrade gracefully instead of freezing. It was designed to be low-granularity, returning coarse pressure states like “nominal,” “fair,” “serious,” or “critical” rather than precise numbers.

CVE-2026-13935 showed that even these coarse signals are enough to build a timing side-channel. An attacker’s script could continuously read the pressure state and correlate its fluctuations with cryptographic operations, keystroke processing, or DOM rendering in another tab. Over time, statistical analysis could extract small pieces of sensitive information—a technique known as a cross-origin information leak via microarchitectural side-channels.

In Chrome’s bug disclosure, the team explained that the flaw resided in the way the browser’s renderer process exposed pressure observations to JavaScript. In certain conditions, a high-precision timer in the attacker’s page could detect the subtle performance impact of a victim’s browsing activity in another origin, effectively turning the CPU load monitor into a covert data channel. The fix adds a mitigation that disables the most fine-grained pressure readings by default and enforces cross-origin isolation requirements for the API’s full feature set.

What actually arrived in Chrome 150.0.7871.47

The stable channel update for Windows and Mac landed with a single CVE listed in the release notes: CVE-2026-13935, marked as High. Google’s customary practice is to withhold technical specifics until a majority of users have updated, but the initial narrative makes clear that the fix touches the window.PressureObserver interface and its worker counterpart.

For users on Windows or Mac, the version bump to 150.0.7871.47 will install silently in the background, provided automatic updates are enabled. Chrome shows the update prompt on relaunch; users who have not restarted their browser in a few days will see the familiar “Update” button in the top-right corner. The update does not require a system reboot.

Enterprise administrators managing Chrome via Group Policy or cloud management have a straightforward deployment path: the latest MSI and PKG packages have been posted to the Chrome Enterprise download page. No new policies are required for the fix, and existing policies that control update cadences (such as the force-installed Web Store extension or minimum Chrome version enforcement) remain unchanged.

The patch is notably absent for Linux and ChromeOS because, as Google confirmed in the developer thread, the Compute Pressure API on those platforms returns a limited subset of data that does not offer sufficient resolution to mount the attack. Developers on Linux or ChromeOS who manually query the API’s state property will find it already mapped to a coarser estimator, making the side-channel impractical.

What it means for everyday users

If you use Chrome on a Windows laptop or a Mac and routinely keep five or ten tabs open—email, banking, social media, a shared Google Doc—you were potentially exposed. The attack required no click on a link inside the malicious page, no permission prompt, no extension installation. Just loading a page could activate a script that gradually pieced together data from other origins.

The silver lining is that the exploit was not trivial: an attacker needed to craft a statistically sophisticated extraction method and then lure a victim to the attack page for a sustained period. Still, the fix closes a class of bugs that security researchers often call “ghost in the gaps”—vulnerabilities that sit at the intersection of hardware telemetry and web platform features, where browser isolation models become murky.

For the average home user, the best action is to confirm that Chrome has updated itself. Type chrome://settings/help into the address bar, and if the version string reads 150.0.7871.47 or higher, you are protected. If not, the page will trigger an update check. Relaunching the browser after the download completes activates the new code.

For power users and system administrators

Organizations that rely on Chrome for internal tools should treat this as a high-priority patch. While the damage is limited to cross-origin information leaks—no remote code execution or sandbox escape—the data that could be exfiltrated includes session tokens, CSRF tokens, or sensitive content from web-based administrative interfaces. In a worst-case scenario, an attacker could use the leak to chain further exploits, like taking over an admin session on a router configuration page.

IT teams should:

  • Verify the update has deployed across all managed Windows and Mac fleets. For Windows, the file version of chrome.dll inside the installation directory will be 150.0.7871.47.
  • If Chrome updates are throttled through a controlled rollout schedule, consider temporarily accelerating the deployment window for this release. Google’s stable channel published the fix for full availability on the same day, so there is no staggered percentage rollout for this specific patch.
  • Note that any enterprise gateway or proxy that recompresses JavaScript traffic may interfere with the timing characteristics of the attack, but do not rely on this as a mitigation—the fix must be applied to the endpoint.
  • Review browser usage policies for high-risk roles: users who regularly browse untrusted sites or open email links in Chrome should be prioritized.

Developers whose web apps use the Compute Pressure API should audit their implementation. The new behavior mandates that high-fidelity pressure readings are only available in contexts that are both crossOriginIsolated and served over HTTPS. If your app relied on fine-grained pressure state to adjust rendering, it may now receive “nominal” or “serious” only, unless you explicitly enable COOP, COEP, and CORP headers. The Chrome Platform Status entry for the original API notes that this restriction had been planned for origin trials, but the side-channel finding accelerated the rollout.

How we got here: a timeline of the Compute Pressure API

The Compute Pressure API first surfaced in developer previews in Chrome 125, shipping behind a flag. The goal was to give web applications performance feedback without exposing hardware-unique identifiers. By January 2026, it reached stable in a coarse form that returned only a single enumerated state for the entire device. Researchers quickly noticed that this state was refreshed at a frequency that could sample system activity at sub-second intervals, creating a side-channel surface.

In early 2026, academic papers at NDSS and WOOT demonstrated that JavaScript-based CPU pressure monitors could be used to infer coarse user activity in other browser processes, but no exploit against the official API had been published. Google’s own Chrome Vulnerability Rewards Program (VRP) report from an anonymous researcher, filed in February 2026, provided a proof-of-concept showing cross-origin script snooping on a MacBook Pro M3 running Chrome 148. The bug was triaged, fixed in trunk, and merged into the stable branch as CVE-2026-13935, hitting the stable channel on the Wednesday patch cycle.

The disclosure timeline was compressed: from the initial VRP report to the stable fix, roughly five weeks elapsed. Google paid out a bounty under the Chrome VRP, though the amount has not been disclosed. The patch was backported to the Extended Stable channel for Windows and Mac, which also received a point release.

Immediate actions you should take

Check your version
Open Chrome, click the three-dot menu > Help > About Google Chrome. If the displayed version is 150.0.7871.47 or newer, the patch is active. If an older version appears, Chrome will download the update automatically; click “Relaunch” to finish.

If you’re on Windows and Chrome won’t update
Download the offline installer from google.com/chrome. Corporate users can push via standard software deployment tools. The MSI installer has the build baked in, so a clean install will also resolve the vulnerability.

On Mac
Quit Chrome entirely. Reopen it, and the update should apply. If you use a package manager like Homebrew Cask, brew upgrade --cask google-chrome will pull the latest stable build.

What about other Chromium browsers?
Edge, Brave, Vivaldi, and Opera build on the Chromium engine but follow their own release cadences. At the time of writing, Microsoft Edge had not yet issued a patch; the Edge team usually picks up critical Chromium fixes within 48–72 hours via their own Security Update Guide. Users of alternative browsers should verify their browser’s release notes or update status page for the equivalent fix. Until confirmed, the safest option is to use Chrome for sensitive browsing.

Outlook: what to watch next

Google’s rapid dispatch of this update signals that the side-channel class is being taken seriously, but the root issue—the tension between useful telemetry APIs and the unintended information channels they create—will likely surface again. The Compute Pressure API is just one of many High-Performance Web APIs (including WebGPU, SharedArrayBuffer, and experimental sensor APIs) that open new fingerprinting and side-channel surfaces. Browser vendors are already discussing adding mandatory cross-origin isolation requirements for any API that returns device performance data at granularity below one second.

For enterprises, this incident reinforces the argument for allowing automatic browser updates without delay. Chrome’s six-week stable cycle plus on-demand security fixes means that delaying updates, even by a few days, leaves a known exploitable condition on every managed endpoint. This fix, rolled out on a typical Wednesday, closed a High severity bug—no public exploit has been observed yet, but that window is shrinking.

The patch also feeds into the ongoing conversation about what information websites should be able to access without a permission prompt. The original Compute Pressure specification did not require user approval because the data was thought to be too coarse to be harmful. CVE-2026-13935 upends that assumption, and we may soon see permission prompts for CPU status requests in future Chrome releases.