Description

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T21:18:28.173Z",
  "pubdate": "2026-08-18T21:18:28.173Z",
  "executiveSummary": "An information leak vulnerability exists within the Skia graphics library integrated into Google Chrome prior to version 151.0.7922.169, presenting a security severity classified as High by Chromium.\nThis vulnerability allows a remote, unauthenticated attacker to potentially bypass the browser's core web origin policy.\nBy leveraging a specially crafted HTML page, a malicious actor can exploit memory leakage anomalies within the rendering engine to access unauthorized cross-origin data structures.\nThe successful exploitation of this flaw undermines browser isolation boundaries, leading to potential data exfiltration and severe confidentiality breaches.\nNo special privileges or prior user authentication are required, as the attack vector relies on standard web navigation to a malicious resource hosted remotely.",
  "technicalDetails": "The vulnerability resides in the Skia graphics library component utilized by Google Chrome for 2D graphics rendering.\nThe root cause stems from an information leak condition where improper handling of memory structures allows internal state or sensitive heap data to be exposed to higher-level application layers.\nSpecifically, prior to version 151.0.7922.169, rendering operations or memory allocations within the graphics pipeline fail to properly sanitize or restrict access to residual memory regions.\nThe attack flow initiates when a victim navigates to a remote, attacker-controlled web server hosting a crafted HTML page containing malicious payload elements designed to trigger the Skia rendering anomaly.\nUpon rendering the malicious content, the underlying graphics engine inadvertently leaks sensitive data across security boundaries.\nAn attacker leverages this information leak to reconstruct memory layouts, bypass address space layout randomization protections, or directly extract sensitive cross-origin data.\nThis capability directly facilitates a web origin policy bypass, allowing the malicious context to interact with or read data from different origins contrary to the Same-Origin Policy enforcement mechanisms.\nThe exploitation vector is entirely network-exposed through standard browser browsing capabilities without requiring local system access or pre-existing user privileges."
}