EUVD-2026-40659
GHSA-frgv-r5vp-3xhc
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Renderer pre-compromise sets AC:H; UI:R for crafted page delivery; C:H for process memory leak; S:U and I:N/A:N because the flaw neither escapes the sandbox nor affects integrity or availability.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in Skia, Chrome's 2D graphics library, exposes process memory contents to an attacker who has already compromised the renderer process by delivering a crafted HTML page. Affected are all Chrome desktop installations prior to 150.0.7871.47; the confidentiality impact is scoped to renderer process memory, which may contain session tokens, DOM content, or cached credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS Medium score of 5.3 reflects the high attack complexity imposed by the renderer pre-compromise prerequisite.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering library that underpins Chrome's entire rendering pipeline. CWE-457 (Use of Uninitialized Variable) describes the root cause: a memory region allocated within Skia's graphics routines is read before being properly initialized, leaking whatever bytes previously occupied that memory location - a classic info-leak primitive. In the Chrome security model, the renderer process is sandboxed, so uninitialized reads within it are bounded by what the renderer holds in memory; however, that can include sensitive cross-origin data, in-memory credentials, or JavaScript heap contents from active tabs. The Chromium issue tracker reference (issues.chromium.org/issues/513780208) and EUVD-2026-40659 confirm the affected version range as Chrome < 150.0.7871.47 across all desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch as confirmed by the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this version automatically for most users; enterprise administrators should verify managed endpoints via policy reporting or asset inventory tools. No documented workarounds specific to this Skia flaw exist. Compensating controls that reduce the likelihood of reaching the renderer pre-compromise prerequisite include enforcing Chrome's Site Isolation (--site-per-process, enabled by default in modern Chrome), restricting JavaScript execution on untrusted origins via enterprise policy, and deploying browser isolation or RBI solutions - note these reduce exposure to the prerequisite vulnerability class rather than patching the Skia bug itself. Downstream Chromium-based browsers should be evaluated and updated per their own vendor advisories.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today