CVE-2026-106330 in Chrome
Summary
by MITRE • 10/07/2026
Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an information leak within the paint subsystem of Google Chrome, specifically in versions prior to 155.0.8059.39, represents a significant breach of browser isolation principles. This flaw allows a remote attacker to extract sensitive data from one browsing context into another by leveraging a crafted HTML page. The core issue lies in how the rendering engine handles memory allocation and painting operations for canvas elements or other graphical resources. When an attacker constructs a malicious webpage that triggers specific paint commands, they can exploit race conditions or improper state management within the graphics pipeline to read pixel data or internal buffer contents that should remain isolated from external scripts. This type of vulnerability is particularly dangerous because it bypasses standard same-origin policies by exploiting low-level rendering artifacts rather than high-level script execution flaws.
From a technical perspective, this flaw aligns with CWE-200, which categorizes information exposure vulnerabilities where sensitive data becomes available to unauthorized actors without explicit authorization mechanisms being triggered in the application logic. The attack vector typically involves embedding malicious JavaScript within an HTML file that interacts with canvas elements or WebGL contexts. By carefully timing requests and manipulating rendering states, the attacker can force the browser to expose memory contents associated with cross-origin resources. This is not a traditional buffer overflow but rather a logical error in how the paint operation validates access rights before committing graphical data to shared buffers accessible via scripting APIs. The severity is rated as medium because while it does not allow direct code execution or full system compromise, it facilitates surveillance and data theft that can lead to further exploitation chains such as session hijacking or credential harvesting if sensitive user interface elements are rendered in the compromised context.
The operational impact of this vulnerability extends beyond simple data leakage. If an attacker successfully exploits this flaw, they can potentially read content from other tabs or windows within the same browser instance, including private browsing sessions or authenticated web applications. This undermines the fundamental trust model of modern browsers where each tab is expected to operate in a sandboxed environment independent of others. The ability to leak information via crafted HTML means that phishing campaigns or drive-by download attacks could be enhanced with sophisticated data exfiltration techniques. Users visiting malicious sites could have their sensitive information, such as form inputs displayed on screen or images containing confidential details, silently extracted without any visual indication of the breach occurring. This poses a severe risk to privacy and security for individuals using Chrome for banking, email, or corporate communications.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these rendering logic errors have been corrected by the Chromium team. The patch likely includes stricter validation checks within the paint subsystem to ensure that memory reads are properly scoped and do not leak data across origin boundaries. In addition to updating software, users should employ browser extensions that enforce strict content security policies and disable unnecessary features like WebGL if they are not required for their workflow. Security awareness training is also critical; users must remain vigilant against visiting untrusted websites or clicking on suspicious links, as these vulnerabilities often require user interaction with a malicious page to trigger the exploit. Organizations should ensure automated patch management systems are in place to rapidly deploy updates across all endpoints running Chrome, minimizing the window of exposure during which this vulnerability can be exploited by threat actors leveraging ATT&CK techniques related to collection and exfiltration over alternative protocols or local staging before external transmission.