EUVD-2026-93828
GHSA-wrg2-qmh9-jwcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML/graphics content
-
ExecutionTrigger uninitialized read in Skia
-
ImpactExfiltrate leaked cross-origin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires the victim to navigate to an attacker-controlled web page containing specially crafted HTML/graphics that is rendered by Chrome's Skia engine - this user interaction (UI:R) is the primary limiting factor. No authentication, special privileges, or non-default configuration is needed (PR:N), and it works against default Chrome installations rendering web content. The attack is bounded in impact: it only leaks a limited amount of cross-origin data (C:L) and cannot modify data or crash the browser (I:N/A:N). It affects Chrome versions prior to 155.0.8059.39; updated browsers are not vulnerable. |
| Impact | This is a moderate-severity information disclosure bug (CVSS 4.3) in Skia, Chrome's 2D graphics library, caused by use of an uninitialized resource (CWE-908). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) tells a consistent story: it is remotely reachable via the web and needs no privileges, but it does require user interaction (visiting a crafted page), has only low confidentiality impact, and no integrity or availability impact. The signals are not conflicting but they are modest - Chromium rates it 'High' internally (reflecting the cross-origin data leak), yet the external base score is only Medium because the leaked data is limited and there is no code execution. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active or imminent exploitation. Net assessment: this is a real, patch-worthy browser flaw that leaks cross-origin data (defeating the same-origin policy), but with no exploitation evidence it is a routine 'patch on normal browser cadence' issue rather than an emergency. Its practical priority comes almost entirely from Chrome's enormous install base, not from the severity or any exploitation signal. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML/graphics content that triggers the uninitialized-resource condition in Skia when rendered. A victim visits the page, and the attacker reads back residual memory contents belonging to another origin (e.g. tokens or data from a site the victim is logged into), bypassing the same-origin policy. No authentication is required, but the victim must actively load the attacker-controlled page; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cross-origin data disclosure in Google Chrome's Skia graphics engine allows a remote attacker to read limited amounts of data belonging to other origins by getting a victim to open a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) that affects Chrome builds prior to 155.0.8059.39 running on default configurations; no authentication or special privileges are needed, but exploitation hinges entirely on user interaction (UI:R) since the victim must load the attacker's page, which is why the overall severity is only CVSS 4.3 with confidentiality impact limited to C:L and no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the vendor has shipped a fixed release and the underlying bug is tracked as a High-severity Chromium security issue.
RemediationAI
Upgrade Google Chrome to version 155.0.8059.39 or later - the vendor-released patched build referenced in the stable channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; the underlying fix is tracked in the Chromium issue tracker at https://issues.chromium.org/issues/561987051. Because Chrome's auto-update mechanism normally delivers this build within days, the practical remediation is to confirm the installed version (chrome://version) on all managed endpoints and force a relaunch or push the update through enterprise policy so the new binary is actually running, not merely downloaded. No authentication bypass or configuration change enables exploitation, so there is no configuration toggle that fully removes the attack surface; strictly limiting which sites users may visit reduces the chance of landing on a crafted page but is not a substitute for patching since the attack only requires rendering attacker HTML. As compensating controls while rollout is pending, administrators can restrict browsing to trusted origins via URL allow-listing, disable or sandbox high-risk rendering paths, and enable site isolation hardening, but each of these carries usability costs and none of them eliminates the uninitialized-read path itself. Given that no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, patch deployment can follow a normal risk-based schedule rather than an emergency one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is the open-source 2D graphics library embedded in Chromium that handles rasterization, image decoding, canvas rendering, and GPU-accelerated drawing for all web content. CVE-2026-106379 is classified as CWE-908 (Use of Uninitialized Resource), meaning a code path in Skia operates on memory or a resource that was never initialized before use. In a graphics pipeline such as Skia's, this typically results in stale heap or buffer contents (layout guesses, dimensions, or partially populated pixel/image buffers) being consumed by a drawing or allocation routine instead of being zeroed or correctly sized. Because Chrome runs this rendering in a sandboxed renderer that processes content from many origins, the leaked uninitialized contents can carry residual data from previously processed cross-origin rendering operations, which the crafted HTML page can then observe - a classic side-channel-style information disclosure rather than a memory-corruption primitive. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms a network-reachable, low-complexity, unauthenticated attack that is gated by user interaction and yields only a limited confidentiality loss within the same security scope, with no impact on integrity or availability. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* marks the entire Google Chrome product line as the affected asset prior to the fixed build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remotely reachable via web with no privileges (AV:N/PR:N) but requires the victim to load a crafted page (UI:R); impact is limited cross-origin data disclosure only (C:L/I:N/A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB