CVE-2026-79147 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Skia graphics library, which serves as the core rendering engine for Google Chrome prior to version 152.0.7977.65, represents a critical information disclosure flaw that exploits the boundary between isolated browser processes. This issue is classified under CWE-200, Information Exposure, and aligns with MITRE ATT&CK technique T1005, which involves data from local system memory being accessed by an attacker. The severity of this vulnerability is rated as low within the Chromium security framework because it requires a specific precondition to be met before exploitation can occur, yet its existence highlights persistent challenges in maintaining strict process isolation boundaries in complex web browsers.
The technical root cause lies in how Skia handles graphical resources and memory allocation during the rendering pipeline. When Chrome processes HTML content that includes crafted graphics or canvas operations, the renderer process interacts with the GPU via the Skia library to accelerate drawing commands. In vulnerable versions of this software stack, improper handling of certain graphic states or texture bindings can lead to a scenario where data from one context leaks into another unintended memory space accessible by the compromised renderer. This typically occurs when shared resources are not correctly cleared or isolated between different rendering contexts, allowing residual data from previous operations to persist in ways that can be read out through subsequent crafted instructions embedded within malicious HTML pages.
The operational impact of this vulnerability is contingent upon the attacker's ability to compromise the renderer process first. In modern browser architectures like Chromium, each tab and extension runs in a separate sandboxed process with restricted permissions designed to prevent access to sensitive user data such as cookies, passwords, or local file system contents. Therefore, an external remote attacker cannot directly exploit this flaw from a standard web page without first leveraging another vulnerability, such as a cross-site scripting attack or a zero-day renderer escape, to gain code execution within the sandboxed environment. Once inside the renderer process, however, the attacker can craft specific HTML and JavaScript payloads that trigger the Skia information leak, potentially extracting sensitive graphical data or memory contents that were not intended for public access.
Mitigation strategies primarily involve upgrading Google Chrome to version 152.0.7977.65 or later, where patches have been applied to correct the resource handling logic within Skia and enforce stricter isolation of rendering contexts. For organizations unable to patch immediately, implementing strict Content Security Policy headers can help mitigate the risk by preventing the execution of untrusted scripts that might attempt to exploit this flaw. Additionally, deploying browser extensions that restrict canvas access or monitor for anomalous GPU memory usage patterns may provide an additional layer of defense against exploitation attempts targeting renderer process boundaries.