CVE-2026-17745 Overview
CVE-2026-17745 is an out-of-bounds read vulnerability [CWE-125] in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium team rated the security severity as Medium.
Exploitation requires prior compromise of the renderer, making this a second-stage vulnerability used to break out of the browser sandbox. Successful exploitation can move an attacker from a constrained renderer context toward code execution with higher privileges on the host.
Critical Impact
Attackers who have already gained renderer-level code execution can chain this Skia out-of-bounds read to attempt a sandbox escape via a malicious web page.
Affected Products
- Google Chrome Desktop prior to 151.0.7922.72
- Chromium-based browsers that embed the affected Skia code
- Applications bundling vulnerable Chromium/Skia versions
Discovery Timeline
- 2026-07-30 - CVE-2026-17745 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17745
Vulnerability Analysis
The issue resides in Skia, the 2D graphics library that Chrome uses to render HTML canvas, SVG, and other visual content. An out-of-bounds read [CWE-125] occurs when code reads memory beyond the intended buffer boundary. In this case, a crafted HTML page can steer Skia into reading memory outside allocated bounds during graphics operations.
Out-of-bounds reads in a renderer-adjacent component are frequently used to leak information across the sandbox boundary. Attackers can use leaked pointers or memory contents to defeat address space layout randomization (ASLR) and build a reliable sandbox escape primitive.
Google addressed the issue in Chrome 151.0.7922.72 on the Stable channel. See the Google Chrome Desktop Update and Chromium Issue #500172224 for release details.
Root Cause
The root cause is missing or insufficient bounds validation in a Skia code path that handles attacker-influenced graphics data. When the affected path processes a crafted input from a compromised renderer, it dereferences memory beyond the intended object, returning data that should not be accessible.
Attack Vector
The attack requires two stages. First, the attacker must compromise Chrome's renderer process, typically through a separate memory-corruption bug reachable from a web page. Second, the attacker delivers a crafted HTML page that triggers the Skia out-of-bounds read to leak information or corrupt state that assists a sandbox escape.
The vulnerability is not directly exploitable by an unprivileged attacker without an existing renderer foothold. It is, however, a valuable component in an exploit chain aimed at breaking out of Chrome's sandbox.
Detection Methods for CVE-2026-17745
Indicators of Compromise
- Chrome renderer or GPU processes crashing with access-violation signatures referencing Skia modules.
- Unexpected child processes spawned by chrome.exe following visits to untrusted pages.
- Browser telemetry showing sandbox policy violations or broker process anomalies.
Detection Strategies
- Inventory Chrome and Chromium-based browser versions across managed endpoints and flag anything below 151.0.7922.72.
- Correlate browser crash reports with navigation history to identify pages that trigger Skia faults.
- Monitor for post-exploitation behavior such as credential access, LSASS interaction, or persistence following browser crashes.
Monitoring Recommendations
- Enable Chrome crash reporting and centralize logs for security review.
- Alert on new processes launched by Chrome renderer or GPU processes that fall outside the expected sandbox broker set.
- Track outbound connections initiated shortly after Chrome renderer restarts on suspicious domains.
How to Mitigate CVE-2026-17745
Immediate Actions Required
- Update Google Chrome to 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
- Update all Chromium-based browsers and embedded browser components to versions that incorporate the fixed Skia code.
- Restart Chrome after applying the update to ensure the patched binaries are loaded.
Patch Information
Google released the fix in Chrome Stable channel 151.0.7922.72. Details are available in the Google Chrome Desktop Update announcement. Downstream Chromium-based browsers should ship equivalent Skia updates.
Workarounds
- Enforce automatic Chrome updates through enterprise policy to reduce patch lag.
- Restrict browsing to trusted sites via web filtering until patches are deployed fleet-wide.
- Disable or restrict extensions that increase renderer attack surface on high-risk endpoints.
# Verify installed Chrome version on Linux
google-chrome --version
# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# macOS: read version from Info.plist
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
