Description

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-06T22:16:58.343Z",
  "pubdate": "2026-08-06T22:16:58.343Z",
  "executiveSummary": "An uninitialized use vulnerability exists within the Skia graphics library in Google Chrome prior to version 151.0.7922.109, presenting a significant security risk to affected systems.\nThe flaw allows a remote attacker who has already successfully compromised the renderer process to achieve cross-origin data leakage by leveraging a specially crafted HTML page.\nCategorized with a high severity rating by Chromium security teams, this vulnerability enables unauthorized information disclosure, potentially exposing sensitive cross-origin data normally protected by the Same-Origin Policy.\nExploitation requires the attacker to possess prior execution capabilities within the restricted renderer process sandbox, typically achieved through a separate initial compromise such as a remote code execution or memory corruption bug within the rendering engine.\nThe operational impact centers on the breach of data confidentiality, allowing unauthorized retrieval of restricted resources across security boundaries.",
  "technicalDetails": "The vulnerability resides in the Skia graphics library utilized by Google Chrome for 2D graphics rendering.\nThe root cause stems from the utilization of uninitialized memory variables or buffers within internal Skia rendering routines, leading to unpredictable state management and memory exposure.\nAffected software versions include Google Chrome installations prior to 151.0.7922.109.\nThe attack flow requires the attacker to first compromise the restricted renderer process, establishing arbitrary execution within that sandboxed context.\nOnce execution within the renderer is achieved, the attacker delivers a crafted HTML page containing malicious or malformed graphic payloads processed by the vulnerable Skia component.\nAs the Skia engine processes the malicious graphics operations, it reads from memory locations that contain uninitialized data.\nThis uninitialized memory may hold remnants of sensitive cross-origin data, such as pixel data, document contents, or internal application structures residing within the same process memory space.\nThe attacker extracts this leaked data through side channels or unintended rendering feedback loops induced by the crafted HTML page.\nNetwork exposure is local to the browser context, driven by web content loaded from remote servers or local sources.\nAuthentication and privilege requirements are constrained to possessing code execution capabilities inside the browser renderer process, bypassing the sandbox isolation for data access without requiring elevated operating system privileges."
}