EUVD-2026-91712
GHSA-f6x2-c3qc-93q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted HTML triggering Skia
-
ExploitInteger overflow in graphics rendering
-
ExecutionRead out-of-bounds memory
-
ImpactLeak cross-origin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit or load an attacker-controlled web page containing crafted HTML that forces Chrome's Skia 2D graphics engine down a rendering path that triggers the integer overflow (CWE-190). The limiting factors are significant: user interaction is mandatory (UI:R - the victim must navigate to the malicious content), impact is confined to leaking cross-origin data (C:L; no code execution, integrity, or availability impact), and the affected population is users running Chrome versions prior to 154.0.8037.97. No special non-default configuration is needed - default Chrome rendering is sufficient - but the requirement for active victim navigation meaningfully constrains mass exploitation. |
| Impact | This is a genuinely low-to-moderate real-world risk despite the 'High' Chromium security severity label, which reflects potential impact class rather than exploitability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) scores 4.3 (Medium): network-reachable and low-complexity with no privileges, but requiring user interaction and yielding only limited confidentiality impact (a cross-origin data leak) with no integrity or availability impact and no scope change. The signals are internally consistent and mutually reinforcing: EPSS is low at 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public POC is indicated - all pointing to no active or imminent widespread exploitation. The only countervailing factor is the ubiquity of Chrome, which maximizes the attack surface. No SSVC decision data was provided in the input. Net: a patch-on-normal-cycle browser bug, not an emergency; prioritize via standard Chrome auto-update rather than out-of-band response. No signals conflict in this case. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted content that triggers the integer overflow in Chrome's Skia graphics library when rendered, and lures a victim into visiting it (user interaction is required per UI:R). Successful exploitation leaks limited cross-origin data, potentially exposing information the same-origin policy should have protected. No public exploit code is identified at time of analysis, and exploitation requires the victim to actively load attacker-controlled content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Cross-origin data leakage in Google Chrome versions prior to 154.0.8037.97 stems from an integer overflow in the Skia 2D graphics engine that a remote attacker can trigger by convincing a victim to load a crafted HTML page, allowing data belonging to other origins to be read. The flaw is remotely reachable by unauthenticated attackers per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N), but it mandates user interaction (UI:R) and carries only low confidentiality impact with no integrity or availability effect, for an overall CVSS of 4.3. EPSS is just 0.17% (6th percentile) and there is no public exploit identified at time of analysis, while Chromium's own 'High' severity label reflects the impact class rather than demonstrated exploitability; a vendor patch is available in Chrome 154.0.8037.97.
RemediationAI
Upgrade Google Chrome to 154.0.8037.97 or later - Vendor-released patch: 154.0.8037.97 - using the built-in updater or the stable-channel release noted at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html, and verify the running build from chrome://version after restarting the browser; managed fleets should push the update through standard software distribution tooling and ensure Chrome is fully relaunched, since updates are only applied on restart. Because the flaw is an information-disclosure primitive that crosses origin boundaries, the most effective compensating control while patching is to leave Chrome's Site Isolation enabled (it is on by default; disabling it via enterprise policy widens exposure), at the cost of modest additional memory and occasional per-site process overhead. Organizations unable to patch immediately should shrink the attack surface by restricting browsing to trusted, allow-listed sites and blocking untrusted HTML through a secure web gateway or DNS filtering, accepting the residual risk that no Chrome flag or configuration toggle disables this specific defect. The vendor provides no flag-based workaround, so patching is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is the open-source 2D graphics library that underpins rendering across Chrome and other Chromium-based browsers, and it processes attacker-influenced content every time an untrusted page is composited. The root cause is CWE-190 (Integer Overflow or Wraparound): an arithmetic calculation on size or offset values reachable through a crafted HTML page wraps around, producing a miscalculated bound or undersized buffer when Skia follows a specific rendering path. Because the defect results in improper bounds handling rather than memory corruption that could be steered toward code execution, the realized impact is cross-origin data exposure instead of remote code execution, consistent with the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) which shows unchanged scope, low confidentiality impact only, and mandatory victim navigation. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates the advisory covers the Chrome product family across platforms for all builds below the fixed release, and ENISA EUVD-2026-91712 records the affected range as Chrome versions below 154.0.8037.97. This is a low-to-moderate real-world risk despite the 'High' Chromium severity label, which reflects potential impact class rather than exploitability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no privileges (AV:N/PR:N) but requiring victim navigation (UI:R); only a limited cross-origin data leak, so C:L and I/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB