EUVD-2026-35275
GHSA-vq94-cc3q-gvj8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Chrome's Skia graphics engine (versions prior to 149.0.7827.103) enables cross-origin data leakage via a crafted HTML page, but only after a prior renderer process compromise. The CVSS score of 3.1 (Low) reflects the constrained impact: confidentiality loss is limited in scope, and the prerequisite renderer compromise represents a significant barrier. No public exploit identified at time of analysis, and CISA SSVC confirms exploitation status as none with non-automatable attack surface.
Technical ContextAI
Skia is Google's open-source 2D graphics library embedded in Chrome as its primary rendering engine. The vulnerability is an out-of-bounds read (described by the reporter and tagged as Buffer Overflow) within Skia's processing of graphical content. The listed CWE is CWE-20 (Improper Input Validation), though the described behavior - an out-of-bounds read leading to data leakage - is more canonically aligned with CWE-125; this discrepancy may reflect classification at the root cause (missing bounds check on input) rather than the symptom. The affected component operates within Chrome's sandboxed renderer process, meaning the attacker must already have achieved renderer-level code execution before this vulnerability becomes reachable. Affected versions are all Chrome desktop releases prior to 149.0.7827.103 per EUVD data.
RemediationAI
Update Google Chrome to version 149.0.7827.103 or later, which contains the vendor-released patch as confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome auto-update should apply this fix automatically on most managed and consumer endpoints; administrators should verify update compliance via policy or endpoint management tooling. Because exploitation requires a prior renderer process compromise, organizations with Chrome Enterprise deployments should also audit renderer sandbox integrity policies and ensure Site Isolation is enabled, as this reduces the blast radius of renderer-level exploits that would be prerequisites to triggering this vulnerability. No meaningful workaround short of the patch addresses the root out-of-bounds read in Skia.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today