EUVD-2026-50918
GHSA-jpmv-r2rx-c4p9
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML requiring active user visit; no privileges needed; confidentiality-only impact from uninitialized memory leak with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Technical ContextAI
Skia is Google's open-source 2D graphics library that serves as Chrome's primary rendering engine for drawing web content, images, and UI elements. CWE-457 (Use of Uninitialized Variable) indicates that memory allocated for an internal Skia variable was read before being explicitly initialized, causing the renderer to expose whatever residual data occupied that memory region - potentially heap contents, stack fragments, or data from prior operations in the Chrome process. The vulnerability is scoped to the Windows platform, suggesting a platform-specific code path or memory layout difference in Skia's Windows implementation. The affected component is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to the patched release 151.0.7922.72. Information leaks of this class can theoretically be chained with other vulnerabilities to defeat ASLR or extract secrets from renderer memory, though no such chaining has been reported here.
RemediationAI
The primary fix is upgrading Google Chrome on Windows to version 151.0.7922.72 or later, which is confirmed as available via the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism should deliver this patch automatically to most managed and consumer endpoints; administrators should verify fleet compliance via device management tooling. No workarounds are required given patch availability and the low severity rating. For environments where immediate patching is constrained, the practical compensating control is restricting access to untrusted web content via browser policy (e.g., enforcing Safe Browsing, disabling JavaScript from untrusted origins) - note these controls reduce exposure but do not eliminate the underlying flaw. There are no known side effects to the patch itself.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today