CVE-2026-84359 in Chrome
Summary
by MITRE • 09/02/2026
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the Skia graphics library, which serves as the core 2D graphics engine for Google Chrome prior to version 152.0.7977.75, represents a significant breach in cross-origin isolation mechanisms. This flaw allows an attacker who has achieved code execution within the renderer process of a victim's browser to exfiltrate sensitive data from other origins that are loaded within the same browsing context. The severity is classified as high by Chromium security standards due to the potential for widespread data leakage across different web applications, undermining the fundamental trust model of modern web browsers where distinct domains must remain isolated from one another to prevent unauthorized access.
At a technical level, Skia handles various rendering operations including text layout, image decoding, and vector graphics processing. The specific flaw likely stems from improper handling of graphical state or buffer management during these operations, which inadvertently exposes memory contents that should be sandboxed. When an attacker crafts a malicious HTML page designed to exploit this weakness, they can manipulate the renderer process to read pixel data or other graphical artifacts associated with cross-origin resources. This effectively bypasses the Same-Origin Policy protections intended to restrict how documents or scripts loaded from one origin interact with resources from another origin. The exploitation relies on the attacker's ability to trigger specific rendering paths within Skia that fail to properly clear or isolate memory regions containing sensitive information from previous operations or other tabs.
The operational impact of this vulnerability is severe, particularly in environments where users frequently visit multiple web applications simultaneously. An adversary who compromises a renderer process through any initial vector such as a drive-by download, malicious extension, or phishing site can leverage this flaw to steal cookies, session tokens, personal identifiable information, or proprietary data from other open tabs. This capability transforms what might have been an isolated compromise into a broader breach of user privacy and organizational security boundaries. The ability to leak cross-origin data means that even if the attacker does not directly target a specific high-value site, they can passively monitor activity across multiple domains, potentially leading to account takeover or further lateral movement within enterprise networks if credentials are harvested from internal tools accessed by employees.
This vulnerability aligns with CWE-200, which categorizes information exposure as an improper restriction of information access for unauthorized entities. Furthermore, it maps directly to the ATT&CK technique T1530, Data from Local System, specifically under data staging or exfiltration methods that involve reading files or memory contents without direct user interaction. The exploitation also relates to CWE-284, Improper Access Control, as the renderer process fails to enforce strict boundaries between different origin contexts during graphical rendering tasks. Mitigation strategies primarily focus on applying the latest browser updates provided by Google Chrome to patch the underlying Skia implementation flaws. Additionally, users and administrators should ensure that Site Isolation features are enabled, which restricts how browsers load web content into memory processes, thereby limiting the blast radius of any renderer process compromise. Regular security audits of third-party extensions and strict Content Security Policy implementations can also reduce the attack surface by preventing unauthorized scripts from executing within the browser environment.