Description

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-02T00:18:29.840Z",
  "pubdate": "2026-09-02T00:18:29.840Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified within the Skia graphics engine integrated into Google Chrome.\nThe vulnerability type is categorized as an information leak, allowing an attacker to bypass cross-origin security boundaries.\nThe issue affects Google Chrome versions prior to 152.0.7977.75.\nThe risk implication is high, as it permits unauthorized access to sensitive cross-origin data, potentially exposing user information or credentials.\nSuccessful exploitation requires the attacker to have already achieved a prior compromise of the renderer process.\nBy leveraging a crafted HTML page, an attacker can extract data from other origins that would otherwise be protected by the Same-Origin Policy (SOP).\nGiven the severity and the nature of the renderer process compromise, this vulnerability poses a significant threat to user privacy and session integrity within the browser environment.",
  "technicalDetails": "The vulnerability resides within the Skia graphics library, which serves as the primary 2D graphics engine for the Chromium project. The root cause pertains to improper handling of cross-origin graphics resources during rendering operations, leading to a breakdown in memory isolation between distinct origins.\nUnder normal operating conditions, the browser's renderer process enforces strict SOP restrictions to prevent malicious sites from reading data across different domains. However, the flaw in Skia allows a compromised renderer process to bypass these checks by manipulating the graphics state in a manner that forces the browser to leak pixel data or memory buffer contents containing cross-origin information.\nThe exploitation flow begins with an attacker successfully achieving code execution within the renderer process, typically via a secondary vulnerability such as a use-after-free or memory corruption bug. Once the renderer is compromised, the attacker executes a crafted HTML payload that invokes specific Skia primitives.\nThe payload is designed to trigger an edge case in the graphics pipeline where cross-origin content is rendered into an accessible memory buffer or canvas element. Because the vulnerability involves the underlying graphics processing layer, the browser fails to apply the necessary security masks or access controls that would typically prevent the read-back of cross-origin sensitive data.\nBy observing the manipulated graphics output, the attacker can reconstruct the cross-origin data. The scope of the exfiltrated information depends on the content rendered by the victim across different origins, potentially including session tokens, PII, or internal page structures that were intended to be isolated.\nSince the exploit requires a compromised renderer, it acts as a post-exploitation privilege escalation and data exfiltration primitive within the sandbox. The vulnerability highlights a critical failure in the isolation mechanisms between the GPU/Skia pipeline and the web content security model. The affected component is the Skia integration layer within Chromium, and the flaw persists in all versions prior to 152.0.7977.75. No authentication is required for the exploitation phase beyond the initial renderer compromise, and the attack is entirely client-side, occurring within the context of the user's browser instance."
}