Every CVE Search/ Get API key

CVE-2026-3929

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71...

3.1 LowFix available

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.19%Up 0.2 points since Mar 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-3929
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-1300
Updated
2026-11-02
EUVDEUVD-2026-11450 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
EUVD-2026-11450
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6j39-2hhh-v6j9 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71...

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
GHSA-6j39-2hhh-v6j9
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-1300
Updated
2026-11-02
NVD 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-3929
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-1300
Updated
2026-11-02
OSVALPINE-CVE-2026-3929 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
ALPINE-CVE-2026-3929
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSV 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-3929
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-3929 3.1

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Record
DEBIAN-CVE-2026-3929
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10376-1 No score

chromedriver-146.0.7680.80-1.1 on GA media

These are all security issues fixed in the chromedriver-146.0.7680.80-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10376-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20372-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

  • Chromium 146.0.7680.80: * CVE-2026-3909: Out of bounds write in Skia (boo#1259659)

  • Chromium 146.0.7680.75 (released 2026-03-12) (boo#1259648)

    • CVE-2026-3910: Inappropriate implementation in V8.

  • Chromium 146.0.7680.71 (released 2026-03-11) (boo#1259530)

    • CVE-2026-3913: Heap buffer overflow in WebML
    • CVE-2026-3914: Integer overflow in WebML
    • CVE-2026-3915: Heap buffer overflow in WebML
    • CVE-2026-3916: Out of bounds read in Web Speech
    • CVE-2026-3917: Use after free in Agents
    • CVE-2026-3918: Use after free in WebMCP
    • CVE-2026-3919: Use after free in Extensions
    • CVE-2026-3920: Out of bounds memory access in WebML
    • CVE-2026-3921: Use after free in TextEncoding
    • CVE-2026-3922: Use after free in MediaStream
    • CVE-2026-3923: Use after free in WebMIDI
    • CVE-2026-3924: Use after free in WindowDialog
    • CVE-2026-3925: Incorrect security UI in LookalikeChecks
    • CVE-2026-3926: Out of bounds read in V8
    • CVE-2026-3927: Incorrect security UI in PictureInPicture
    • CVE-2026-3928: Insufficient policy enforcement in Extensions
    • CVE-2026-3929: Side-channel information leakage in ResourceTiming
    • CVE-2026-3930: Unsafe navigation in Navigation
    • CVE-2026-3931: Heap buffer overflow in Skia
    • CVE-2026-3932: Insufficient policy enforcement in PDF
    • CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
    • CVE-2026-3935: Incorrect security UI in WebAppInstalls
    • CVE-2026-3936: Use after free in WebView
    • CVE-2026-3937: Incorrect security UI in Downloads
    • CVE-2026-3938: Insufficient policy enforcement in Clipboard
    • CVE-2026-3939: Insufficient policy enforcement in PDF
    • CVE-2026-3940: Insufficient policy enforcement in DevTools
    • CVE-2026-3941: Insufficient policy enforcement in DevTools
    • CVE-2026-3942: Incorrect security UI in PictureInPicture
Record
openSUSE-SU-2026:20372-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20460-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

  • Chromium 146.0.7680.177 (boo#1261249)

    • CVE-2026-5273: Use after free in CSS
    • CVE-2026-5272: Heap buffer overflow in GPU
    • CVE-2026-5274: Integer overflow in Codecs
    • CVE-2026-5275: Heap buffer overflow in ANGLE
    • CVE-2026-5276: Insufficient policy enforcement in WebUSB
    • CVE-2026-5277: Integer overflow in ANGLE
    • CVE-2026-5278: Use after free in Web MIDI
    • CVE-2026-5279: Object corruption in V8
    • CVE-2026-5280: Use after free in WebCodecs
    • CVE-2026-5281: Use after free in Dawn
    • CVE-2026-5282: Out of bounds read in WebCodecs
    • CVE-2026-5283: Inappropriate implementation in ANGLE
    • CVE-2026-5284: Use after free in Dawn
    • CVE-2026-5285: Use after free in WebGL
    • CVE-2026-5286: Use after free in Dawn
    • CVE-2026-5287: Use after free in PDF
    • CVE-2026-5288: Use after free in WebView
    • CVE-2026-5289: Use after free in Navigation
    • CVE-2026-5290: Use after free in Compositing
    • CVE-2026-5291: Inappropriate implementation in WebGL
    • CVE-2026-5292: Out of bounds read in WebCodecs

  • Chromium 146.0.7680.164 (boo#1260376)

    • CVE-2026-4673: Heap buffer overflow in WebAudio
    • CVE-2026-4674: Out of bounds read in CSS
    • CVE-2026-4675: Heap buffer overflow in WebGL
    • CVE-2026-4676: Use after free in Dawn
    • CVE-2026-4677: Out of bounds read in WebAudio
    • CVE-2026-4678: Use after free in WebGPU
    • CVE-2026-4679: Integer overflow in Fonts
    • CVE-2026-4680: Use after free in FedCM

  • Chromium 146.0.7680.153 (boo#1259964):

    • CVE-2026-4439: Out of bounds memory access in WebGL
    • CVE-2026-4440: Out of bounds read and write in WebGL
    • CVE-2026-4441: Use after free in Base
    • CVE-2026-4442: Heap buffer overflow in CSS
    • CVE-2026-4443: Heap buffer overflow in WebAudio
    • CVE-2026-4444: Stack buffer overflow in WebRTC
    • CVE-2026-4445: Use after free in WebRTC
    • CVE-2026-4446: Use after free in WebRTC
    • CVE-2026-4447: Inappropriate implementation in V8
    • CVE-2026-4448: Heap buffer overflow in ANGLE
    • CVE-2026-4449: Use after free in Blink
    • CVE-2026-4450: Out of bounds write in V8
    • CVE-2026-4451: Insufficient validation of untrusted input in Navigation
    • CVE-2026-4452: Integer overflow in ANGLE
    • CVE-2026-4453: Integer overflow in Dawn
    • CVE-2026-4454: Use after free in Network
    • CVE-2026-4455: Heap buffer overflow in PDFium
    • CVE-2026-4456: Use after free in Digital Credentials API
    • CVE-2026-4457: Type Confusion in V8
    • CVE-2026-4458: Use after free in Extensions
    • CVE-2026-4459: Out of bounds read and write in WebAudio
    • CVE-2026-4460: Out of bounds read in Skia
    • CVE-2026-4461: Inappropriate implementation in V8
    • CVE-2026-4462: Out of bounds read in Blink
    • CVE-2026-4463: Heap buffer overflow in WebRTC
    • CVE-2026-4464: Integer overflow in ANGLE

  • Chromium 146.0.7680.80:

    • CVE-2026-3909: Out of bounds write in Skia (boo#1259659)

  • Chromium 146.0.7680.75 (released 2026-03-12) (boo#1259648)

    • CVE-2026-3910: Inappropriate implementation in V8.

  • Chromium 146.0.7680.71 (released 2026-03-11) (boo#1259530)

    • CVE-2026-3913: Heap buffer overflow in WebML
    • CVE-2026-3914: Integer overflow in WebML
    • CVE-2026-3915: Heap buffer overflow in WebML
    • CVE-2026-3916: Out of bounds read in Web Speech
    • CVE-2026-3917: Use after free in Agents
    • CVE-2026-3918: Use after free in WebMCP
    • CVE-2026-3919: Use after free in Extensions
    • CVE-2026-3920: Out of bounds memory access in WebML
    • CVE-2026-3921: Use after free in TextEncoding
    • CVE-2026-3922: Use after free in MediaStream
    • CVE-2026-3923: Use after free in WebMIDI
    • CVE-2026-3924: Use after free in WindowDialog
    • CVE-2026-3925: Incorrect security UI in LookalikeChecks
    • CVE-2026-3926: Out of bounds read in V8
    • CVE-2026-3927: Incorrect security UI in PictureInPicture
    • CVE-2026-3928: Insufficient policy enforcement in Extensions
    • CVE-2026-3929: Side-channel information leakage in…
Record
openSUSE-SU-2026:20460-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt6-qtwebengine
Alpine:v3.23
 before 6.10.1-r10
6.10.1-r10
qt6-qtwebengine
Alpine:v3.24
 before 6.10.2-r8
6.10.2-r8
chromium
Debian:12
 before 146.0.7680.71-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
146.0.7680.71-1~deb12u1
chromium
Debian:13
 before 146.0.7680.71-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
146.0.7680.71-1~deb13u1
chromium
Debian:14
 before 146.0.7680.71-1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
146.0.7680.71-1
chromium
Debian:12
From an advisory covering 29 CVEs
 before 146.0.7680.71-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
146.0.7680.71-1~deb12u1
chromium
Debian:13
From an advisory covering 29 CVEs
 before 146.0.7680.71-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
146.0.7680.71-1~deb13u1
chromium
openSUSE:Tumbleweed
From an advisory covering 31 CVEs
 before 146.0.7680.80-1.1
146.0.7680.80-1.1
chromium
openSUSE:Leap 16.0
From an advisory covering 86 CVEs
 before 146.0.7680.177-bp160.1.1
146.0.7680.177-bp160.1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-3929 is a low vulnerability (CVSS 3.1) in Google Chrome, published March 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in qt6-qtwebengine 6.10.1-r10.

References

Show 92 moreShow less
This page doesn't list everything

Left out here: 654 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open