Description

Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:48.930Z",
  "pubdate": "2026-08-25T21:17:48.930Z",
  "executiveSummary": "This vulnerability involves an uninitialized resource condition within the Skia graphics library, integrated into the Google Chrome browser.\nThe flaw allows a remote attacker to achieve unauthorized memory disclosure by leveraging a maliciously crafted HTML page.\nImpact is restricted to the browser sandbox environment, but it enables the leakage of sensitive data residing in the renderer process memory space.\nAffected products include Google Chrome versions prior to 152.0.7977.65.\nThe risk is categorized as Low severity by Chromium maintainers, yet it represents a breach of memory safety principles.\nExploitation requires the victim to navigate to a compromised or attacker-controlled webpage, triggering the vulnerable rendering path.\nNo authentication is required for exploitation; however, the impact is confined to the sandbox, necessitating further vulnerabilities for full system compromise.",
  "technicalDetails": "The vulnerability resides within Skia, the 2D graphics library utilized by Chromium for rendering. The root cause is an uninitialized resource state, where the graphics engine processes memory blocks that have not been zero-initialized or otherwise cleared before use.\nIn the context of browser rendering, complex HTML/CSS/SVG compositions can trigger specific code paths within Skia. If an object or buffer is allocated but not properly initialized, the renderer may process or return the contents of the underlying memory—which may contain residual data from previous operations—as part of the rendering output.\nThe attack flow begins when an attacker hosts a crafted HTML document that forces the browser to engage a specific, vulnerable Skia drawing routine. As the Skia engine processes the malicious input, the uninitialized memory segment is accessed. By carefully controlling the memory layout through heap spraying or sequential heap allocations, an attacker can influence the contents of the uninitialized buffer, effectively 'priming' it for readout.\nWhen the renderer process performs the drawing operation, the contents of the uninitialized memory are used to populate pixel buffers or other display structures. An attacker can then exfiltrate this data back to their control server by using side-channel techniques or by forcing the leaked data into observable browser properties, such as image data returned through canvas operations.\nThe vulnerability occurs within the renderer process, which operates under the Chromium sandbox. Consequently, the attacker is limited to data present within that specific process. While the sandbox mitigates full system control, memory disclosure can reveal pointers, cryptographic keys, or session-related tokens residing within the renderer's heap. This data can facilitate more sophisticated attacks, including bypasses of Address Space Layout Randomization (ASLR) or the extraction of sensitive cross-origin data.\nThis issue affects versions of Google Chrome earlier than 152.0.7977.65. There are no authentication or privilege requirements for an attacker; the vulnerability is triggered automatically upon rendering the crafted malicious content in a standard web environment."
}