Chrome 152 Adds CPU Performance API and Allowlists

Chrome 152 ships two browser controls for web apps

Chrome 152 stable landed on August 25th, 2026. The release adds two features that security teams and frontend engineers will both care about: the CPU Performance API and Connection Allowlists.

The first lets a web app learn the CPU performance tier of the device it is running on. The second lets a server narrow which outbound connections a document or worker can make through the Fetch API and other web platform APIs.

That is a small change on paper. In practice, it gives browser code more context about the client and more control over where that client can talk.

If you have been tracking browser platform changes that affect security, this release sits in the same lane as other Chrome changes that reshape the boundary between app logic and browser policy. For background on that broader shift, see Browsers Before AI vs. Now: What Actually Changed for Users.

---

What the CPU Performance API does

The CPU Performance API lets a web application determine the CPU performance tier of a user's device. The draft community group report was published on 15 August 2026, and its abstract says the API exposes information about how powerful the user device is.

The intent is straightforward. Some apps need a coarse signal before they pick a heavy rendering path, a large model, or a background task. Chrome says web applications can use this information to improve user experience, and can combine it with the Compute Pressure API to react to CPU pressure changes.

That combination matters for performance-aware code. A static tier can guide the first decision. Compute Pressure can then help the app respond when the device gets hot, busy, or constrained.

The browser also keeps the final say in the user's hands. Users and administrators can override the reported CPU performance tier using Chrome settings and enterprise policies.

For teams already thinking about how AI-heavy frontends behave on weaker hardware, that signal can matter. If you are building apps that depend on browser-side automation or model-assisted flows, the security question is no longer only "can the code run?" It is also "what assumptions does the app make about the client device, and who can change those assumptions?"

A good next read is AI Coding Tools and AppSec Risk: What to Audit Now, especially if your team ships browser code generated or assisted by AI.

---

How Connection Allowlists work in Chrome 152

Connection Allowlists give developers explicit control over external endpoints. Chrome says the feature restricts connections initiated through the Fetch API and other web platform APIs from a document or worker.

The draft community group report was published on 26 August 2026. Its goal is to provide a concise policy language and delivery mechanism for constraints on a context's ability to communicate with other servers.

The mechanism is simple. Servers distribute an authorized endpoint list through an HTTP response header. Chrome then evaluates destination endpoints against that allowlist before establishing connections.

That design is security-relevant because it makes outbound access part of the browser policy layer instead of only application code. It is also narrowly scoped. The WICG draft says the goal is to mitigate explicit exfiltration channels in a way that is narrowly tailored to the problem.

For readers who already worry about browser-based exfiltration, this is a direct fit. It does not replace server-side controls. It gives web apps one more place to state, in a machine-checkable way, where network traffic may go.

If that sounds familiar, it should. Modern appsec teams have been asking for similar guardrails in other parts of the browser and web platform. The broader pattern shows up in Chrome hardening work around supply-chain attacks too: reduce the blast radius, then make the allowed path explicit.

---

Security impact for browser apps

These features solve different problems, but both push toward more explicit browser policy.

The CPU Performance API gives a site a better guess about client capability. That can improve load decisions, animation choices, media quality, or background processing. It can also become a signal that influences what code runs, how much data is fetched, or which features are exposed.

Connection Allowlists do something more obviously defensive. They limit outbound network paths from browser contexts. That matters when you have untrusted content, complex client-side workflows, or code that might otherwise reach arbitrary endpoints.

From a security review perspective, a few questions now become more concrete:

• Does the app branch on the reported CPU tier in ways that change security behavior?
• Are workers or documents allowed to contact only known endpoints?
• Do any browser-side flows depend on broad network access that should now be narrowed?
• Do overrides in browser settings or enterprise policy change the assumptions your app makes?

Those are the kinds of questions that separate a feature note from a security review.

If your team wants help answering them at the code and policy level, the natural place to start is an AI Code Security Audit when browser logic, generated code, or client-side policy needs a deeper review.

---

What developers should do now

Chrome 152 is not a reason to rewrite your frontend. It is a reason to check where your app trusts the browser too much.

Start with the new CPU signal. If your app changes rendering, data volume, or background work based on device class, document those branches. Make sure the default behavior is safe on every tier, not just fast devices. Treat the browser-reported tier as a hint, not an entitlement.

Then look at outbound access. If your app talks to a fixed set of APIs, consider whether a Connection Allowlists policy fits your architecture. If you already enforce tight egress at the server or proxy layer, use this feature to add another layer of restraint in the client path.

Finally, audit the places where browser policy meets generated code. The more AI helps write client-side logic, the more likely it is to create broad network assumptions or brittle device checks. For teams seeing that pattern, the right move is not to ban the tools. It is to review the code paths that those tools produce.

Chrome 152 also includes a deprecation trial for client-side XSLT, which is another reminder that browser behavior keeps shifting under real applications. Keep an eye on release notes, pin down the network paths your app depends on, and test the security impact of any browser feature before you ship it.