CVE-2026-11675: Google Chrome Information Disclosure Flaw

CVE-2026-11675 Overview

CVE-2026-11675 is an out-of-bounds read vulnerability in the Skia graphics library used by Google Chrome versions prior to 149.0.7827.103. A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page. The flaw is categorized under CWE-20: Improper Input Validation and affects Chrome on Windows, macOS, and Linux. Google's Chromium project rated the underlying issue as High severity, while NVD scored it Low due to the prerequisite of a compromised renderer and required user interaction.

Critical Impact
An attacker chaining this bug with a renderer compromise can read cross-origin memory, undermining Chrome's site isolation guarantees and exposing sensitive web data.

Affected Products

Google Chrome prior to 149.0.7827.103
Chromium-based browsers on Microsoft Windows, Apple macOS, and Linux
Embedded applications using vulnerable versions of the Skia rendering library

Discovery Timeline

2026-06-09 - CVE-2026-11675 published to NVD
2026-06-09 - Last updated in NVD database
2026-06-09 - Google releases Chrome Stable Channel update addressing the issue

Technical Details for CVE-2026-11675

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics engine that Chrome uses to rasterize HTML, CSS, Canvas, and SVG content. Skia processes untrusted geometric and image data inside the sandboxed renderer process. An out-of-bounds read occurs when Skia accesses memory past the end of an allocated buffer while handling a malformed drawing operation triggered from a crafted HTML page.

The read does not corrupt memory, but it discloses adjacent heap contents to JavaScript running in the renderer. When combined with a prior renderer compromise, an attacker can use the leak to bypass Chrome's cross-origin isolation and exfiltrate data from other origins sharing the same process boundary.

Exploitation requires user interaction, such as navigating to attacker-controlled content, and assumes the attacker has already achieved code execution inside the renderer through a separate bug.

Root Cause

The root cause is improper input validation [CWE-20] in Skia's parsing of drawing parameters. The library fails to verify that an index or offset stays within the bounds of the source buffer before performing a memory read. Crafted inputs supplied through HTML, Canvas, or SVG drawing primitives drive the read past the buffer boundary.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a page containing the malicious Skia payload in a browser that an attacker has already partially compromised. The full exploitation chain typically involves a renderer-side remote code execution bug followed by this information disclosure primitive to defeat site isolation and read cross-origin secrets such as authentication tokens or DOM content.

Technical details and reproduction artifacts are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-11675

Indicators of Compromise

Chrome renderer processes crashing with SIGSEGV or STATUS_ACCESS_VIOLATION in Skia drawing routines while visiting untrusted sites
Unexpected outbound connections from browser hosts following navigation to attacker-controlled HTML, Canvas, or SVG content
Endpoints running Chrome builds older than 149.0.7827.103 after the Stable Channel update became available

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 149.0.7827.103
Monitor browser telemetry for repeated renderer crashes correlated with Skia stack frames, which can indicate exploitation attempts or fuzzing
Inspect web proxy logs for suspicious HTML payloads delivering large or malformed Canvas, WebGL, or SVG resources

Monitoring Recommendations

Centralize browser version reporting and crash telemetry in a SIEM or data lake for longitudinal analysis
Alert on outbound data transfers from browser processes that deviate from baseline volume or destinations
Track navigation events to newly registered or low-reputation domains preceding renderer crashes

How to Mitigate CVE-2026-11675

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints
Restart browsers after deployment to ensure patched binaries load in all renderer processes
Audit Chromium-derived browsers and embedded WebView components for the patched Skia version

Patch Information

Google addressed CVE-2026-11675 in the Stable Channel update for desktop released on 2026-06-09. Administrators should review the Google Chrome Stable Update announcement and roll the patch through enterprise update channels such as Chrome Browser Cloud Management or platform package managers.

Workarounds

Enforce Chrome auto-update policies via group policy or MDM to keep installations current
Restrict browsing to trusted sites using URL filtering or DNS controls while patch deployment is in progress
Disable unnecessary rendering features such as experimental Canvas or WebGL flags on high-risk user groups

bash

# Configuration example: enforce minimum Chrome version via Windows Group Policy registry key
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "149.0.7827.103" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v UpdateDefault /t REG_DWORD /d 1 /f