EUVD-2026-23038Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Requires user interaction to visit a malicious page, resulting only in low confidentiality impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Information disclosure in Google Chrome prior to 147.0.7727.101 allows a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. No public exploit or active exploitation has been identified at this time, and EPSS indicates very low exploitation probability (0.01%).
Technical ContextAI
This vulnerability exists in the Skia 2D graphics library, which Chrome uses for rendering web content. A heap buffer overflow (CWE-122) in Skia can occur when processing maliciously crafted HTML pages. Improper bounds checking leads to memory reads outside the intended buffer, exposing potentially sensitive process memory. The affected product is confirmed by CPE as Google Chrome.
RemediationAI
Upgrade Google Chrome to version 147.0.7727.101 or later. The vendor has released a patch, and automatic updates will apply the fix. The primary remediation is to ensure all Chrome installations are updated to the patched version. For environments unable to upgrade immediately, reducing user exposure to untrusted web content can lower risk, but this is a temporary measure.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today