EUVD-2026-50707
GHSA-9hv5-9rmh-pgr6
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no auth needed, but victim must actively navigate; impact limited to partial cross-origin data leak with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.
Technical ContextAI
Skia is the open-source 2D graphics library that underpins all rendering in Google Chrome and Chromium-based browsers, processing draw calls for every tab, iframe, and canvas element. CWE-457 (Use of Uninitialized Variable) arises when memory is allocated but not zeroed before use, causing the processing logic to operate on whatever bytes happened to occupy that memory region previously. In a browser rendering engine context this is acutely dangerous: because Skia handles rendering for multiple origins in shared process memory (depending on site isolation configuration), uninitialized buffers may contain stale data from another origin's rendered content. The affected product is confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, spanning all Chrome desktop builds prior to 151.0.7922.72 across Windows, macOS, and Linux.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for the Skia uninitialized memory issue. Chrome auto-updates by default; administrators and users should verify their installed version at chrome://settings/help and trigger a manual update if the version displayed is below 151.0.7922.72. The stable channel advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a partial compensating control pending patching, ensuring Chrome's Site Isolation feature is active (default in modern Chrome; verify via chrome://flags/#site-per-process) limits cross-origin memory sharing between renderer processes, though it does not fully eliminate the uninitialized memory root cause in Skia. No other workaround fully substitutes for the vendor patch.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today