CVE-2026-79144 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Skia graphics library, which serves as the core rendering engine for Google Chrome prior to version 152.0.7977.65, represents a critical information disclosure flaw that undermines browser isolation mechanisms. This security severity issue stems from an improper handling of memory or data structures during the processing of crafted HTML content, allowing a remote attacker to bypass same-origin policies and access sensitive cross-origin data. The root cause lies in how Skia processes graphical primitives when rendering complex web pages; specifically, certain operations fail to properly validate boundaries or sanitize inputs before writing to shared buffers or returning state information that can be read by the JavaScript engine. This flaw enables an adversary to construct a malicious webpage containing specially crafted HTML and CSS elements designed to trigger specific rendering paths within Skia where sensitive memory contents are inadvertently exposed back to the web context rather than being isolated in secure, non-readable regions of memory.
From a technical perspective, this vulnerability aligns with CWE-200, which categorizes information exposure vulnerabilities that result from improper handling of confidential data. The attack vector relies on social engineering or drive-by download tactics where an unsuspecting user visits a compromised website hosting the malicious HTML payload. Once rendered by Chrome, the Skia engine executes code paths that leak internal state variables, such as canvas pixel buffers, font metrics, or other graphical context details associated with cross-origin resources. This leakage occurs because the browser fails to enforce strict separation between data belonging to different origins during the rasterization process. The attacker can then extract this leaked information through JavaScript APIs that query rendering results, effectively turning a graphics processing function into an unauthorized data exfiltration channel.
The operational impact of this vulnerability is significant as it facilitates cross-origin data theft without requiring user interaction beyond visiting the malicious site. Attackers can exploit this to steal session cookies, authentication tokens, or private content from other domains that are loaded within iframes or accessed via AJAX requests by the victim's browser. This compromises the fundamental security model of web browsers, which relies on strict origin isolation to prevent one website from accessing data belonging to another. In enterprise environments where employees may access sensitive internal applications alongside public websites, this vulnerability could lead to unauthorized access to corporate resources or intellectual property theft if an attacker can trick a user into loading their exploit page while authenticated sessions for target domains are active in the same browser instance.
Mitigation strategies primarily involve updating Google Chrome and its underlying Skia library components to version 152.0.7977.65 or later, where these boundary checks and memory isolation protocols have been strengthened. Security administrators should ensure that automatic updates are enabled for all endpoints running affected versions of the browser. Additionally, organizations can implement Content Security Policy headers to restrict inline scripts and reduce the attack surface available to such exploits, although this does not directly patch the underlying rendering engine flaw. Monitoring network traffic for unusual data exfiltration patterns related to canvas or image processing APIs may also help in detecting active exploitation attempts before significant damage occurs.
This incident is mapped to MITRE ATT&CK technique T1005, which describes Data from Local System, specifically under sub-techniques involving application window memory or local file access depending on the exact mechanism of data retrieval. It also relates to T1074, Data Staged, as the attacker stages stolen cross-origin information for exfiltration. The vulnerability highlights the importance of rigorous code auditing in graphics libraries that interact closely with browser security boundaries, ensuring that all graphical operations respect origin checks and do not inadvertently expose internal state to untrusted web contexts.