CVE-2026-3929: 
vulnerability analysis and mitigation

CVE-2026-3929 is a side-channel information leakage vulnerability in the ResourceTiming API of Google Chrome that allows a remote attacker to leak cross-origin data via a crafted HTML page. It affects all versions of Google Chrome prior to 146.0.7680.71, as well as Microsoft Edge (Chromium-based). The vulnerability was reported by Povcfe of Tencent Security Xuanwu Lab on January 20, 2026, and publicly disclosed on March 10–11, 2026, when Chrome 146 was promoted to the stable channel. It carries a CVSS v3.1 base score of 3.1 (Low) and is rated Medium severity by Chromium's internal classification (Chrome Release, Microsoft MSRC).

The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels) and stems from insufficient isolation of timing information exposed through the browser's ResourceTiming API. By crafting a malicious HTML page, a remote attacker can observe subtle timing differences in resource loading to infer information about cross-origin resources that would otherwise be protected by the Same-Origin Policy. Exploitation requires user interaction (visiting the attacker-controlled page) and involves high attack complexity, as the attacker must carefully measure and interpret timing side-channel signals. The Chromium bug tracker reference for this issue is #477180001 (Chrome Release).

Successful exploitation results in a limited confidentiality breach — specifically, the leakage of cross-origin data that should be inaccessible to the attacker's origin. There is no impact on integrity or availability. The practical risk includes potential exposure of sensitive metadata about resources loaded from other origins (e.g., authenticated endpoints, internal URLs), which could be used to fingerprint user activity or infer the presence of specific cross-origin content. The scope is limited to the browser context and does not directly enable code execution or system compromise (Chrome Release).

Google has addressed this vulnerability in Chrome 146.0.7680.71 (Linux) and 146.0.7680.71/72 (Windows/Mac), released on March 10, 2026. Users should update Google Chrome to version 146.0.7680.71 or later via the browser's built-in update mechanism (Settings → Help → About Google Chrome). Microsoft Edge (Chromium-based) users should apply the corresponding Edge update. No configuration-based workaround is available; upgrading to the patched version is the only remediation. Given the medium/low severity, this patch can be incorporated into regular patching cycles rather than treated as an emergency update (Chrome Release, Microsoft MSRC).

The vulnerability was part of a broader Chrome 146 security update that addressed 29 security issues, which received coverage from security news outlets such as GBHackers. Downstream Linux distributions including Debian, Fedora (42, 43, 44), and openSUSE issued Chromium security advisories incorporating this fix. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-3929 has been identified, consistent with its medium/low severity classification (Chrome Release).