EUVD-2026-93615
GHSA-m7w3-vvj6-p2p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file via social engineering
-
DeliveryVictim opens file in Chrome
-
ExploitSkia parses malformed graphics data
-
ExecutionOut-of-bounds read past buffer
-
ImpactAdjacent process memory disclosed
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the targeted user to locally open an attacker-crafted file that is rendered via Chrome's Skia graphics library (AV:L, UI:R) - this is the specific prerequisite, so the attack cannot occur without victim interaction driven by social engineering. There is no authentication requirement (PR:N), but the mandatory user interaction, local delivery, and the fact that only a small amount of memory can be read (C:L, no integrity/availability impact) sharply limit real-world risk. Browsers at or above version 155.0.8059.39 are not affected. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) describes a local, user-interaction-dependent out-of-bounds read with only low confidentiality impact and no integrity or availability impact - Google itself rated the Chromium severity as Low. EPSS reinforces this: 0.11% probability in the 1st percentile indicates virtually no observed exploitation interest. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active or opportunistic exploitation. One minor nuance worth flagging: the CVSS vector lists AV:L (local) while the description frames delivery via a 'crafted file' and social engineering - these are compatible (the victim must locally open attacker-supplied content), but it is not remote network exploitation. No SSVC decision data was supplied. Net: a low-CVSS, low-EPSS, no-KEV, no-POC memory-disclosure bug that should be remediated through normal Chrome auto-update cycles, not emergency patching. |
| Exploit ScenarioDerived | An attacker socially engineers a victim into opening a maliciously crafted file (e.g., an image or graphics resource) rendered through Chrome's Skia library. The out-of-bounds read then leaks small fragments of adjacent process memory to the attacker-controlled content. No public proof-of-concept is known, and successful exploitation requires the targeted user to actively open the attacker's file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
An out-of-bounds read in Google Chrome's Skia graphics rendering library (CWE-125) allows an attacker to read a limited amount of process memory when a victim is socially engineered into opening a crafted file that Chrome renders, with the flaw present in all Chrome builds prior to 155.0.8059.39. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) shows no authentication requirement but a mandatory victim interaction and only a low-confidentiality memory exposure with no integrity or availability impact, which keeps real-world risk small; Google rates it Low. EPSS is 0.11% (1st percentile), no public exploit has been identified at time of analysis, and Chrome builds at or above 155.0.8059.39 are not affected.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.39, which removes the out-of-bounds read; upgrade Chrome to that version or later and verify the build via chrome://version, using the built-in updater or the standard channel package from the release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, and confirm the fix status in the Chromium tracker entry https://issues.chromium.org/issues/530237174. Because patching is straightforward and the flaw carries only low confidentiality impact, no workaround is appropriate as a substitute for upgrading; if an immediate update is impossible, reduce exposure by preventing Chrome from auto-opening untrusted files (configure download handling to save rather than open, and avoid opening untrusted images, fonts or PDFs directly in Chrome), accepting the usability cost of extra clicks, and keep the renderer sandbox and site isolation enabled so that any leaked memory remains confined to an isolated renderer - disabling the sandbox would trade this low-severity memory read for a much larger weakness. Restricting or blocking local file rendering in Chrome is technically awkward and disruptive and should be treated only as a temporary stopgap until 155.0.8059.39 is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is the 2D graphics engine used across Chrome to decode, rasterize and composite images, fonts, PDFs and other rendered content, which places it directly in the parsing path for untrusted files. The root cause is an out-of-bounds read (CWE-125): a length or index derived from crafted file content is used without adequate bounds validation against the underlying buffer, so the renderer reads past the end of an allocated structure. The tags 'Buffer Overflow' and 'Information Disclosure' reflect this pattern, though the assessed impact is disclosure only rather than memory corruption. The attack surface is local (AV:L) with required user interaction (UI:R) and no privileges required (PR:N) - the attacker must get a victim to open a malicious file that Chrome hands to Skia, which the independent assessment characterises as a social-engineering-driven prerequisite; the outcome is a small, low-confidentiality memory leak (C:L) with no write primitive and no denial-of-service effect, and the Chrome renderer sandbox further constrains what any leaked memory could reveal. The single CPE associated with this CVE is the wildcard cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. any Chrome version below the fixed release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Crafted file opened locally by the victim gives AV:L and UI:R; no auth needed (PR:N); an out-of-bounds read leaks limited memory (C:L) with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB