Description

Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:09.930Z",
  "pubdate": "2026-08-25T21:18:09.930Z",
  "executiveSummary": "A security vulnerability categorized as an information leak exists within the Skia graphics library integrated into Google Chrome. This flaw allows a remote attacker, who has already achieved arbitrary code execution within the restricted renderer process sandbox, to exfiltrate sensitive memory contents. The vulnerability affects Google Chrome versions prior to 152.0.7977.65. While the vulnerability is classified with a Low severity rating by the Chromium project, it represents a significant failure in the isolation of graphics processing memory. The primary implication is the potential for bypassing memory layout randomization (ASLR) or extracting secrets processed within the renderer's address space. Successful exploitation requires the attacker to have first compromised the renderer process, typically through a separate browser-level vulnerability, to leverage the Skia flaw for further reconnaissance or cross-origin data exposure.",
  "technicalDetails": "The vulnerability resides within the Skia graphics engine, a 2D graphics library utilized by Chromium for rendering web content. The root cause pertains to an improper handling or validation of graphics-related data structures or state within the Skia pipeline when processing specific, maliciously crafted HTML and CSS inputs. By triggering certain code paths in the renderer process, an attacker can coerce the library into performing out-of-bounds memory reads or exposing heap-allocated data that should remain inaccessible to the renderer's application logic.\nThe attack flow initiates when a compromised renderer process receives a crafted HTML document containing specialized rendering instructions designed to trigger the Skia defect. Because the renderer process is responsible for drawing web elements, it interacts directly with the Skia engine. If the attacker has previously successfully exploited a memory corruption vulnerability to gain control over the renderer's instruction pointer or data flow, they can invoke specific Skia function calls with manipulated parameters. These parameters influence the engine's internal memory access patterns, leading to the leakage of sensitive data stored in the address space of the renderer process.\nThe information leak occurs when the Skia engine incorrectly returns or displays memory contents instead of the expected graphical output. By observing the rendered results or extracting the data through script-based access to the Canvas API or other DOM-interfacing graphics interfaces, the attacker can recover memory contents. This behavior effectively bypasses the intended memory isolation policies of the Chromium security model. The impact of such a leak is critical in multi-stage exploit chains; while the renderer process itself is already partially compromised, the leaked data may contain pointers or static values necessary to defeat address space layout randomization (ASLR) or extract sensitive cryptographic keys or session tokens residing within the renderer's heap. This increases the efficacy of further post-exploitation activities, such as executing more complex attacks or attempting to escape the renderer sandbox to the browser process or underlying operating system."
}