EUVD-2026-40506
GHSA-5h6r-3v8v-3wq4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; S:C applies because the flaw breaches cross-origin boundaries; no integrity or availability impact applies.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data disclosure in Google Chrome's Skia graphics library on macOS allows a remote attacker who has already achieved renderer process compromise to trigger an out-of-bounds read and leak memory contents from other web origins via a crafted HTML page. All Chrome versions on Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified and this vulnerability is absent from CISA KEV; an EPSS of 0.21% at the 11th percentile confirms very low near-term exploitation probability, and SSVC classifies exploitation status as none - indicating this is a chaining primitive in multi-stage attack chains, not a standalone threat.
Technical ContextAI
The vulnerability is rooted in CWE-125 (Out-of-bounds Read) within Skia, Chrome's open-source 2D graphics rendering engine responsible for canvas operations, image decoding, and GPU compositing. On macOS specifically, a flaw in Skia's rendering code path allows a crafted HTML page to trigger a read beyond the intended buffer boundary within the renderer process sandbox. Because Skia processes content from multiple origins as part of page rendering, the out-of-bounds read can expose memory holding cross-origin data, violating the Same-Origin Policy at the memory level. The affected product is Google Chrome on macOS (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), with the flaw confined to the renderer execution context and not generalized to Chrome on Windows or Linux per CVE description scope.
RemediationAI
The primary fix is upgrading to Google Chrome 150.0.7871.47 or later on macOS, as confirmed by the vendor advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update will deploy this silently for most users; enterprise administrators using managed deployments via Google Admin Console or third-party MDM should verify version compliance across their macOS fleet. As a defense-in-depth measure while updates propagate, enabling or verifying Chrome's Strict Site Isolation (chrome://flags/#enable-site-per-process) limits cross-origin data access in compromised renderer contexts, though it does not eliminate the underlying Skia out-of-bounds read and should not substitute for patching. No effective standalone workaround exists to mitigate the Skia flaw without the vendor-provided patch.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today