Catalog/PERFORMANCE/core-web-vitals
SCAN-ID: CORE-WEB-VITALSREVISION 2026.4
PERFORMANCECVSS 5.2 (MEDIUM)

Core Web Vitals & Speed Scanner

Measure LCP, INP, CLS, TTFB, and runtime render performance to guarantee sub-second page loads.

Technical Scope & Verification Behavior

Audits Largest Contentful Paint (LCP < 2.5s), Interaction to Next Paint (INP < 200ms), Cumulative Layout Shift (CLS < 0.1), Time to First Byte (TTFB), total blocking time, and image payload compression.

Automated Inspection Checks (15)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

LCP: 4.8s (Poor) - Unoptimized 4.2MB hero PNG image

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Next.js Image Optimization

patch.diff (tsx)
--- a/handler.tsx (Vulnerable)
<img src="/hero-large.png" />
+++ b/handler.tsx (Remediated)
<Image src="/hero-large.png" alt="Hero" width={1200} height={600} priority placeholder="blur" />

Use next/image with WebP/AVIF compression and priority flag to achieve sub-second Largest Contentful Paint.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Convert raw img tags to next/image with explicit dimensions and priority on above-the-fold hero banners."

Run Isolated Check

Test your public domain specifically for Core Web Vitals & Speed Scanner.

100% passive • No server load

Specification Details

CVSS Score
5.2 / 10.0
Severity Level
MEDIUM
Category
PERFORMANCE
Test Vectors
15 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#LCP#INP#CLS#Speed#Web Vitals

Run continuous monitoring for Core Web Vitals & Speed Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog