EUVD-2026-50720
GHSA-88wm-m3gh-5wjp
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page (AV:N), no privilege required (PR:N), mandatory user visit (UI:R), limited to partial confidentiality loss with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering library embedded in Chrome, Android, Flutter, and other platforms. CWE-457 (Use of Uninitialized Variable) occurs when memory is allocated but not zeroed or otherwise initialized before use; in a rendering context, this can expose prior allocation contents - potentially including data from other origins loaded in the same process or renderer - to JavaScript or page-visible outputs. The Chromium security model relies heavily on process isolation, but intra-renderer uninitialized reads can still breach logical same-origin boundaries depending on renderer architecture and site isolation configuration. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions before 151.0.7922.72 on all platforms (Windows, macOS, Linux).
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch confirmed via the Chrome stable channel update advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically for most users; administrators managing enterprise deployments should push this version via Google Admin Console or group policy. As a temporary compensating control where immediate updates are not feasible, enabling Chrome's Strict Site Isolation (chrome://flags/#enable-site-per-process) reduces the cross-origin data exposure surface by placing each origin in a separate renderer process, though this increases memory usage and may affect performance. Blocking untrusted or unsolicited HTML content via web filtering or browser policies (e.g., restricting navigation to allowlisted domains) limits user exposure to crafted pages but does not eliminate the underlying vulnerability.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today