EUVD-2026-50828
GHSA-5m9w-9f93-mcj8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML (AV:N), but renderer compromise prerequisite imposes high complexity (AC:H); impact is strictly limited to partial confidentiality disclosure (C:L, I:N, A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Technical ContextAI
Skia is Google's open-source 2D graphics library that serves as the primary rendering backend in Chrome and Chromium-based browsers. CWE-346 (Origin Validation Error) indicates that the flaw is a failure to properly enforce origin boundaries within Skia's rendering implementation - the engine does not correctly validate or isolate cross-origin graphical data during composition or rasterization operations. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Google Chrome desktop versions prior to 151.0.7922.72 are affected. Because exploitation requires a pre-compromised renderer, this vulnerability is relevant in a sandbox-escape or browser-chain attack context: a first-stage renderer exploit enables access to Skia's internals, and this second-stage flaw then leaks data from cross-origin frames or resources within the same browser session.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-confirmed patched release per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism delivers this fix automatically for most consumer installations; enterprise administrators should verify rollout via Chrome Enterprise or Google Admin Console policies and confirm the installed version is at or above 151.0.7922.72. No standalone workaround eliminates the Skia flaw itself, but enabling Chrome's Site Isolation (enabled by default in modern Chrome) and ensuring renderer sandboxing is not disabled via enterprise policy removes the primary prerequisite for exploitation - a compromised renderer - thereby breaking the attack chain before this vulnerability can be reached.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today