EUVD-2026-50828
GHSA-5m9w-9f93-mcj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate renderer vulnerability to gain renderer code execution
-
DeliveryServe crafted HTML page to victim browser
-
ExploitTrigger Skia Origin Validation Error via renderer-level Skia API access
-
ExecutionRead cross-origin frame or resource data bypassing same-origin policy
-
ImpactExfiltrate leaked cross-origin data to attacker-controlled endpoint
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the attacker to have already compromised the Chrome renderer process through a separate, prior vulnerability - this is explicitly stated in the CVE description and is the dominant constraint. User interaction is required (UI:R per CVSS): the victim must navigate to or load a crafted HTML page under attacker influence. High attack complexity (AC:H) reflects the chained prerequisite. No authentication on the target system is required (PR:N). Factors limiting exploitation include: (1) attacker must possess renderer-level code execution prior to triggering this flaw, acquired through an independent unpatched or zero-day vulnerability; (2) victim must actively visit attacker-controlled or attacker-influenced HTML content; (3) a cross-origin resource of value must be accessible within the victim's active browser session for data exfiltration to be meaningful. Default Chrome configurations with Site Isolation enabled significantly raise the bar for renderer compromise, which is the prerequisite for this vulnerability. |
| Impact | The CVSS 3.1 base score of 3.1 (Low) is consistent across all available signals. AV:N establishes network delivery, but AC:H and the explicit prerequisite of a compromised renderer process impose a significant exploitation barrier not fully captured by the vector alone. UI:R adds a further dependency on victim interaction. EPSS at 0.29% (21st percentile) confirms low real-world exploitation probability. SSVC signals Exploitation: none, Automatable: no, and Technical Impact: partial - all consistent with a chained, non-trivial attack rather than a standalone critical flaw. There is no CISA KEV listing and no confirmed public exploit. The impact is strictly limited to confidentiality (C:L) with no integrity or availability dimensions. Despite Chrome's ubiquitous deployment footprint, the requirement for a prior renderer compromise drastically reduces the realistic attacker population to sophisticated actors capable of chaining multiple browser exploits. This is a low-priority standalone vulnerability but a relevant second-stage component in advanced browser exploit chains. |
| Exploit ScenarioDerived | A sophisticated attacker who has already exploited a separate, unrelated renderer-level vulnerability in Chrome delivers a crafted HTML page to the victim, triggering the Skia Origin Validation Error to read and leak data from a cross-origin context loaded in the same browser session - such as authentication tokens or page content from a banking or enterprise web application. No public exploit or proof-of-concept code has been identified at time of analysis, and the multi-stage nature of this attack makes opportunistic or mass exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-confirmed patched release per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism delivers this fix automatically for most consumer installations; enterprise administrators should verify rollout via Chrome Enterprise or Google Admin Console policies and confirm the installed version is at or above 151.0.7922.72. No standalone workaround eliminates the Skia flaw itself, but enabling Chrome's Site Isolation (enabled by default in modern Chrome) and ensuring renderer sandboxing is not disabled via enterprise policy removes the primary prerequisite for exploitation - a compromised renderer - thereby breaking the attack chain before this vulnerability can be reached.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is Google's open-source 2D graphics library that serves as the primary rendering backend in Chrome and Chromium-based browsers. CWE-346 (Origin Validation Error) indicates that the flaw is a failure to properly enforce origin boundaries within Skia's rendering implementation - the engine does not correctly validate or isolate cross-origin graphical data during composition or rasterization operations. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Google Chrome desktop versions prior to 151.0.7922.72 are affected. Because exploitation requires a pre-compromised renderer, this vulnerability is relevant in a sandbox-escape or browser-chain attack context: a first-stage renderer exploit enables access to Skia's internals, and this second-stage flaw then leaks data from cross-origin frames or resources within the same browser session.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML (AV:N), but renderer compromise prerequisite imposes high complexity (AC:H); impact is strictly limited to partial confidentiality disclosure (C:L, I:N, A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB