CVE-2026-106379 Overview
CVE-2026-106379 is an uninitialized resource vulnerability in the Skia graphics library used by Google Chrome. Versions prior to 155.0.8059.39 allow a remote attacker to obtain cross-origin data by serving a crafted HTML page to a victim. The flaw is tracked under [CWE-908: Use of Uninitialized Resource] and Chromium classifies the internal security severity as High, though the public CVSS score is 4.3. Successful exploitation requires user interaction, specifically loading an attacker-controlled page. The issue impacts confidentiality by leaking data from other origins, violating the same-origin policy enforced by the browser.
Critical Impact
Attackers can read small amounts of cross-origin data rendered through Skia, enabling targeted information disclosure against users browsing malicious or compromised sites.
Affected Products
- Google Chrome (Desktop) versions prior to 155.0.8059.39
- Chromium-based browsers embedding the vulnerable Skia component
- Downstream distributions bundling pre-patch Chromium builds
Discovery Timeline
- 2026-10-06 - CVE-2026-106379 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-106379
Vulnerability Analysis
The vulnerability resides in Skia, the 2D graphics engine Chrome uses to rasterize web content, canvas operations, and image decoding. Skia allocates buffers or graphics resources that are not fully initialized before use. When the renderer processes crafted drawing operations from a malicious HTML page, residual memory contents are incorporated into pixel data accessible from JavaScript. An attacker can then read back these pixels through APIs such as CanvasRenderingContext2D.getImageData() or WebGL readbacks, bypassing cross-origin restrictions. The leaked bytes may contain fragments of memory belonging to other origins, including tokens, response bodies, or user data previously processed by the renderer process.
Root Cause
The root cause is a missing initialization step within a Skia resource allocation path. [CWE-908] vulnerabilities occur when a program uses a resource whose contents are not deterministically set. In this case, graphics buffers retain stale memory from previous operations and are exposed back to script contexts without sanitization.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that triggers the vulnerable Skia code path, typically through canvas, WebGL, or image rendering operations. Once the victim visits the page, the renderer leaks uninitialized bytes that the attacker's JavaScript reads and exfiltrates. No authentication or elevated privileges are required.
No verified proof-of-concept code is publicly available. Technical details are tracked in Chromium Issue Tracker #561987051, which remains restricted pending broader patch adoption.
Detection Methods for CVE-2026-106379
Indicators of Compromise
- Browser telemetry showing Chrome versions below 155.0.8059.39 connecting to untrusted domains.
- Web pages invoking repeated getImageData() or WebGL readPixels() calls against freshly allocated canvases with no visible rendering purpose.
- Outbound requests transmitting base64-encoded pixel buffers to attacker-controlled infrastructure.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag endpoints below the fixed build.
- Inspect proxy logs for HTML responses containing obfuscated canvas or WebGL readback patterns targeting unpatched clients.
- Correlate browser process memory read anomalies with navigation events to newly observed domains.
Monitoring Recommendations
- Enforce browser version reporting through enterprise management policies and alert on drift.
- Monitor DNS and HTTP egress for connections to low-reputation domains hosting canvas-heavy payloads.
- Review endpoint detection telemetry for Chrome renderer processes exhibiting unusual network behavior following page loads.
How to Mitigate CVE-2026-106379
Immediate Actions Required
- Update Google Chrome to version 155.0.8059.39 or later on all managed endpoints.
- Restart Chrome after update to ensure the patched Skia library is loaded into all renderer processes.
- Audit third-party Chromium-based browsers and embedded webviews for equivalent patched builds.
Patch Information
Google released the fix in the Chrome Stable channel update documented at the Google Chrome Stable Update advisory. The patch addresses the uninitialized Skia resource and restores correct cross-origin isolation for canvas and WebGL readbacks. Enterprise administrators should distribute the update through standard channels such as Chrome Browser Cloud Management or Group Policy.
Workarounds
- Restrict user navigation to trusted sites through web filtering policies until the patch is deployed.
- Disable hardware acceleration temporarily to reduce exposure of GPU-backed Skia paths, accepting the performance trade-off.
- Block script execution on untrusted origins using enterprise extensions or Content Security Policy enforcement at the gateway.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
