CVE-2026-17757: Google Chrome Skia Information Disclosure

CVE-2026-17757 Overview

CVE-2026-17757 is an uninitialized memory use vulnerability in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker to leak cross-origin data through a crafted HTML page. Chromium rates the security severity as Medium.

Skia is the 2D graphics engine that Chrome uses to render web content, canvas elements, and images. The uninitialized use condition falls under [CWE-457], where a program reads memory that has not been assigned a defined value.

Critical Impact
A remote attacker can leak cross-origin data by rendering a crafted HTML page, breaking the same-origin policy that isolates content between web origins.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable Skia component
Desktop stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17757 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17757

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses for rasterization and canvas rendering. Skia reads a memory location that was allocated but never initialized with a defined value. When that memory is subsequently used in a rendering pipeline, residual bytes from prior allocations can influence pixel output or computation results.

Because Chrome exposes rendering results back to JavaScript through APIs such as <canvas>, WebGL, and getImageData(), uninitialized bytes can be reflected into content accessible from the attacker's origin. This allows an attacker to observe fragments of memory that may contain data from other origins loaded in the same process.

The issue is classified as [CWE-457] Use of Uninitialized Variable. See the Chromium Issue Tracker Entry for the upstream reference.

Root Cause

The root cause is a code path in Skia that allocates a buffer or structure and passes it into a rendering operation without first zeroing or explicitly writing every field. When the graphics pipeline consumes those fields, it treats residual heap contents as valid input.

Attack Vector

An attacker hosts a crafted HTML page that triggers the vulnerable Skia code path through specific rendering primitives. A victim visits the page in an unpatched Chrome build. The page reads back rendered pixel or buffer data and exfiltrates it to an attacker-controlled endpoint, bypassing the same-origin policy for the leaked bytes.

No verified proof-of-concept code is published. Refer to the Google Chrome Security Update for vendor details.

Detection Methods for CVE-2026-17757

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on endpoint inventory reports
Outbound HTTPS requests from browser processes to unfamiliar domains following visits to untrusted pages
Unexpected canvas or WebGL activity in browser telemetry when rendering third-party content

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Correlate browser process telemetry with navigation to newly registered or low-reputation domains
Monitor for browser child processes making anomalous network egress after loading external HTML content

Monitoring Recommendations

Track Chrome update compliance through enterprise management channels such as Chrome Browser Cloud Management
Log DNS and TLS SNI activity from browser processes to identify contact with attacker infrastructure
Alert on endpoints that remain on outdated Chrome versions beyond the organization's patch service level agreement

How to Mitigate CVE-2026-17757

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart browser sessions after the update so the patched binary is loaded into memory
Audit third-party Chromium-based browsers and Electron applications for embedded Skia versions and update where vendors provide fixes

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Security Update. Chrome versions 151.0.7922.72 and later contain the corrected Skia code path.

Workarounds

Restrict browsing to trusted sites through enterprise URL allow-lists until patching is complete
Enable Chrome's Site Isolation policy so cross-origin content is rendered in separate processes, limiting the scope of leaked memory
Disable hardware acceleration only if operationally acceptable, as it changes some Skia rendering paths

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: check the bundle version
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString