EUVD-2026-54129
GHSA-rhp6-q4j8-v7v5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory prior renderer compromise; C:L captures limited cross-origin leak with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Skia graphics library (versions prior to 151.0.7922.109) enables a remote attacker who has already achieved renderer process compromise to extract cross-origin data through a specially crafted HTML page. The vulnerability is classified CWE-457 (Use of Uninitialized Variable) and carries a low CVSS base score of 3.1, reflecting its dependency on a pre-existing renderer compromise as a prerequisite. No public exploit code has been identified at time of analysis, SSVC exploitation status is rated none, and a vendor-released patch is available in Chrome 151.0.7922.109.
Technical ContextAI
Skia is the open-source 2D graphics library embedded in Chromium and used to render web content including HTML canvas, SVG, and general page layout. CWE-457 (Use of Uninitialized Variable) indicates that Skia reads from memory that was allocated but never properly initialized, meaning the raw contents of that memory region - which may contain residual data from prior allocations - become accessible. In Chrome's multi-process architecture, the renderer process handles page content in a sandboxed environment isolated from the browser process. This vulnerability is exploitable only within that sandbox, specifically when an attacker already controls renderer execution, making it a chaining vulnerability rather than a standalone entry point. The affected CPE scope is Google Chrome prior to 151.0.7922.109 on desktop platforms.
RemediationAI
The primary fix is to upgrade Google Chrome to version 151.0.7922.109 or later, which is confirmed as the patched release by the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's auto-update mechanism will deliver this patch to most desktop users automatically; administrators managing enterprise deployments should verify policy-enforced version floors are raised to 151.0.7922.109. As a compensating control, organizations that cannot immediately update should consider enabling Chrome's 'Strict Site Isolation' policy (--site-per-process), which limits cross-origin memory exposure even if the renderer is compromised, though this does not eliminate the underlying uninitialized memory flaw. Restricting access to untrusted web content via proxy filtering or browser extension policies may reduce exposure surface but will not prevent exploitation if a renderer-level compromise occurs through other vectors.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today