What is the CVSS score of CVE-2026-76041?

CVE-2026-76041 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-76041?

Yes, a patch is available for CVE-2026-76041. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-76041

EUVD-2026-61234 MEDIUM

Information Exposure (CWE-200)

2026-08-18 chrome-cve-admin@google.com

GHSA-x6v5-hh3v-cp8g

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page (AV:N), victim must visit it (UI:R), no auth needed (PR:N), limited cross-origin info leak only (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 12:31 vuln.today

CVSS changed

Aug 19, 2026 - 12:23 NVD

4.3 (MEDIUM)

CVE Published

Aug 18, 2026 - 21:18 cve.org

MEDIUM 4.3

CVE Published

Aug 18, 2026 - 21:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Victim visits attacker-controlled URL

Exploit

Chrome's Skia engine processes crafted rendering content

Execution

Information leaks across web origin boundary

Impact

Attacker reads cross-origin sensitive data

Access

Attacker crafts malicious HTML page

Delivery

Victim visits attacker-controlled URL

Exploit

Chrome's Skia engine processes crafted rendering content

Execution

Information leaks across web origin boundary

Impact

Attacker reads cross-origin sensitive data

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively visit or be redirected to a crafted HTML page - the CVSS UI:R metric confirms this mandatory passive user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.3 Medium score reflects a real but constrained risk: network-reachable, low-complexity, no-privilege attack limited by mandatory user interaction (UI:R) and low confidentiality impact (C:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that triggers the Skia rendering information leak, then delivers it via phishing, malicious advertising, or a compromised website. When the victim visits the page, the rendering pipeline discloses cross-origin information - potentially exposing data from other tabs or resources loaded in the browser session - which the attacker's JavaScript can then read and exfiltrate. …
Remediation	Update Google Chrome to version 151.0.7922.169 or later, which is the vendor-released patch addressing this vulnerability per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. … Detailed patch versions, workarounds, and compensating controls in full report.