EUVD-2026-41169
GHSA-2wv3-7v49-h6mj
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory prerequisite renderer compromise; UI:R for required victim navigation; C:H for process memory read; I:N and A:N as no write or crash impact applies.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
Technical ContextAI
Skia is the open-source 2D graphics rendering library embedded in Chrome and used for all drawing operations including text, images, and vector paths. CWE-20 (Improper Input Validation) here indicates Skia does not adequately sanitize attacker-controlled data - likely image decoding or path-rendering operations triggered by HTML content - before operating on it within renderer process memory. The vulnerability occurs entirely within the Chromium renderer sandbox (S:U in the CVSS vector), meaning it cannot directly affect the host OS. Affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions below 150.0.7871.46.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.46 or later, per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will handle this for most consumer deployments; enterprise administrators should verify that managed browser policies push the update promptly. SUSE-managed environments should apply Chrome package updates via the standard distribution update pipeline. As a compensating control where immediate patching is delayed, confirming that Chrome's Site Isolation is active (already default in modern versions) reduces cross-origin memory exposure within the renderer sandbox, though it does not eliminate the underlying Skia validation flaw. No other workaround fully addresses the root cause.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today