EUVD-2026-33153
GHSA-7mc4-mv93-3wr7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome) · only source for this CVE.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leak in Google Chrome's Skia graphics engine affects all versions prior to 148.0.7778.216, exploitable only after an attacker has already achieved renderer process compromise via a separate vulnerability. The flaw (CWE-200) allows the compromised renderer to exfiltrate cross-origin data by processing a crafted HTML page, with impact limited to partial confidentiality loss. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence of CISA KEV listing confirm low widespread exploitation probability, though the renderer-compromise prerequisite implies real-world use would appear in chained exploit scenarios.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering engine embedded in Chrome, responsible for painting web content, compositing layers, and canvas operations. An inappropriate implementation within Skia - classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - allows rendering operations to surface data from cross-origin contexts that should be isolated by the browser's same-origin policy. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop variants prior to 148.0.7778.216 carry the flaw. Because exploitation requires a pre-existing renderer process compromise, this vulnerability is most relevant as a second-stage component in a multi-stage exploit chain, where a renderer RCE is chained with this info-leak to exfiltrate sensitive cross-origin pixel or canvas data.
RemediationAI
Update Google Chrome to version 148.0.7778.216 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise deployments should force-update via Chrome Browser Cloud Management, Active Directory group policy (ExtensionInstallForcelist), or equivalent MDM policy, ensuring auto-update is not blocked. Because exploitation requires a pre-existing renderer compromise, defenders should treat any indicator of renderer-level exploitation as the higher-severity upstream condition to remediate first - patching this CVE in isolation does not close renderer RCE vectors that would serve as preconditions. No effective workaround exists short of patching, as Skia is a core rendering component that cannot be disabled.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today