EUVD-2026-69731
GHSA-5hrf-vhf5-vjmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver renderer exploit via malicious web content
-
DeliveryCompromise Chrome renderer process
-
ExploitLoad crafted HTML page triggering Skia leak path
-
ExecutionRead cross-origin pixel/memory data
-
ImpactExfiltrate sensitive cross-origin content to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two distinct prerequisites: (1) the attacker must have already compromised the Chrome renderer process via a separate vulnerability, and (2) the victim user must visit or have open a crafted HTML page in the same browser session. The renderer compromise is the hard prerequisite - this CVE alone grants no initial access. Limiting factors: Chrome's sandbox architecture means a renderer compromise does not automatically yield OS-level access; this flaw only extends the impact to cross-origin data within the browser. Default Chrome configurations with site isolation enabled compartmentalize renderers per origin, which may limit but does not fully prevent exploitation of this path once a renderer is already under attacker control. |
| Impact | The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N yields a base score of 3.1 (Low), reflecting that exploitation requires both prior renderer compromise (AC:H) and user interaction. However, Google's internal Chromium severity is 'High', suggesting the security team views the cross-origin data leak as high-value in a real exploit chain - a renderer compromise paired with this flaw can exfiltrate sensitive data from other origins (e.g., session tokens, private content), materially increasing the value of an initial renderer exploit. EPSS data is not provided in the input, and no KEV listing exists, indicating no confirmed broad automated exploitation. The real-world risk is primarily relevant to targets already under active browser exploitation campaigns where chained exploits are used; for general enterprise populations the standalone risk is limited absent the renderer RCE prerequisite. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer-process vulnerability in Chrome delivers a crafted HTML page that triggers the Skia information-leak path, causing the compromised renderer to read and exfiltrate pixel or memory data from a cross-origin resource - for example, the rendered content of a logged-in banking session open in another tab. No public exploit code is identified at time of analysis; real-world use would require chaining with a separate renderer RCE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
RemediationAI
Update Google Chrome to version 152.0.7977.75 or later, which contains the vendor-released patch per the Chrome Releases advisory at chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this to most desktop users automatically; administrators managing enterprise deployments should verify update propagation via policy. Because exploitation requires prior renderer compromise, organizations running Chrome in high-risk environments should also enforce site isolation (--site-per-process, enabled by default in modern Chrome) to reduce the blast radius of renderer-level exploits, and consider restricting access to sensitive web applications from browsers not under enterprise patch management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is Google's open-source 2D graphics library, embedded directly in the Chrome renderer process and used to rasterize and composite web content. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the Skia rendering pipeline incorrectly exposes pixel or memory data that should be isolated by the browser's cross-origin resource policy. In a Chromium renderer-process sandbox model, cross-origin isolation is enforced at multiple layers including the renderer itself; this flaw indicates that a compromised renderer can leverage a Skia code path to read data from a cross-origin context that should be opaque. Affected product is Chrome prior to 152.0.7977.75 per EUVD-2026-69731.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H captures mandatory renderer-compromise prerequisite; C:L reflects limited cross-origin data leak with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB