EUVD-2026-28001Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in Skia graphics library within Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. The vulnerability requires user interaction and relies on renderer compromise, limiting real-world exploitation despite the information disclosure impact. Chromium classified this as Medium severity; no active exploitation has been publicly confirmed.
Technical ContextAI
The vulnerability exists in Skia, Google's 2D graphics rendering library integrated into Chrome. CWE-125 (Out-of-bounds Read) indicates improper bounds checking in memory access operations within the Skia rendering pipeline. An attacker exploiting this must first compromise Chrome's renderer process-a sandboxed environment separate from the main browser process-and then craft a malicious extension to trigger the out-of-bounds memory read. This read operation can expose data from adjacent memory regions, potentially leaking information from cross-origin contexts that should be isolated. The attack surface is narrowed by the renderer sandbox and the need for prior process compromise.
RemediationAI
Users should immediately update Google Chrome to version 148.0.7778.96 or later via Settings > About Chrome, which will auto-update or prompt for restart. The patch is vendor-released and available from Google Chrome's stable release channel (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). No workarounds are available short of disabling extensions or avoiding untrusted websites that might attempt renderer exploitation through other vectors. Enterprise administrators can enforce automatic updates via Chrome policies (ChromeVariations, Update policies) to ensure rapid deployment. Note that this fix addresses only the Skia out-of-bounds read; organizations must continue monitoring for and patching the initial renderer compromise vector, which is the real attack prerequisite.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today