EUVD-2026-54130
GHSA-qqjw-v6cg-96j4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; C:L captures cross-origin data leak only; I:N and A:N confirmed by description; PR:N as attacker needs no privileges beyond the chained renderer access.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in Skia, Chrome's 2D graphics engine, exposes a cross-origin data leak primitive in Google Chrome prior to 151.0.7922.109. Exploitation is constrained to attackers who have already achieved renderer process compromise - making this a second-stage, chained vulnerability rather than a standalone initial-access vector. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, consistent with the low CVSS base score of 3.1.
Technical ContextAI
Skia is Google's open-source 2D graphics library embedded in Chrome, responsible for rendering graphics operations across web content. CWE-457 (Use of Uninitialized Variable) describes a class of flaw where memory is read before it has been properly initialized, causing it to contain stale or adjacent heap/stack data. In the browser context, this means uninitialized Skia state could expose memory contents from other origins, violating the Same-Origin Policy. The affected versions are all Chrome releases prior to 151.0.7922.109, as indicated by the EUVD range 'Chrome 151.0.7922.109 < 151.0.7922.109'. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reflects network reachability but flags high attack complexity and user interaction as limiting factors.
RemediationAI
Update Google Chrome to version 151.0.7922.109 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's auto-update mechanism should deliver this fix automatically on most deployments; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or Group Policy. No specific workaround is practical for this class of vulnerability given it resides within the graphics rendering pipeline - disabling JavaScript or restricting HTML rendering would have severe usability trade-offs and are not recommended. Prioritize patching environments where users may be targeted in multi-stage browser exploit chains, such as high-value targets exposed to spear-phishing.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today