CVE-2026-17914: Google Chrome Skia Information Disclosure

CVE-2026-17914 Overview

CVE-2026-17914 is a side-channel information leakage vulnerability in the Skia graphics library used by Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this flaw by serving a crafted HTML page to obtain potentially sensitive information from process memory. Google's Chromium security team has rated the severity as Low. The weakness is classified under CWE-1300 (Improper Protection of Physical Side Channels), indicating the flaw arises from observable behavior in Skia's rendering operations rather than direct memory corruption.

Critical Impact
Remote attackers can leak sensitive data from the Chrome renderer process memory by luring users to a malicious web page that triggers Skia side-channel behavior.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable Skia builds
Applications relying on the Skia graphics library shipped with pre-151 Chrome

Discovery Timeline

2026-07-30 - CVE-2026-17914 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17914

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library Chrome uses to rasterize HTML, CSS, Canvas, and WebGL content. Skia processes untrusted graphics operations initiated by web content inside the renderer process. The flaw allows a crafted HTML page to induce measurable side-channel behavior during rendering. An attacker observing that behavior can infer data from adjacent process memory that should not be exposed to web content. The issue is categorized under CWE-1300, which addresses improper protection of physical side channels in graphics or computation paths.

Root Cause

The root cause is insufficient isolation between rendering operations in Skia and sensitive memory contents within the same process. Timing, cache effects, or rendering outputs vary based on values in memory that should remain opaque to script. This category of flaw does not corrupt memory but leaks information through observable side effects of legitimate graphics operations.

Attack Vector

Exploitation requires a remote attacker to host or inject a crafted HTML page and have the victim visit it in an unpatched Chrome build. No authentication is needed. The attacker uses JavaScript and HTML primitives that reach the vulnerable Skia code path, then measures rendering side effects to reconstruct information from process memory. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for release-level context.

Detection Methods for CVE-2026-17914

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 after the vendor patch date.
Web sessions that repeatedly load pages exercising unusual Canvas, WebGL, or complex CSS graphics workloads from untrusted origins.
Outbound connections from user endpoints to newly registered or low-reputation domains serving heavy client-side rendering payloads.

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across managed endpoints and flag builds below 151.0.7922.72.
Correlate browser process telemetry with visits to untrusted domains that request extensive graphics API usage.
Monitor for unpatched browsers used by high-value accounts such as administrators and finance users.

Monitoring Recommendations

Ingest browser version telemetry into your SIEM and alert when endpoints drift below the patched release.
Track DNS and proxy logs for connections to domains hosting attacker-controlled graphics payloads.
Review endpoint EDR telemetry for anomalous child processes or memory access patterns originating from renderer processes.

How to Mitigate CVE-2026-17914

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Force browser restarts through configuration management to apply the patch on active sessions.
Prioritize patching for users who handle sensitive data or credentials in the browser.

Patch Information

Google addressed the flaw in Chrome Stable 151.0.7922.72. Refer to the Google Chrome Desktop Update advisory for the full list of fixes and to the Chromium Issue Tracker Entry for issue-level details. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors ship builds incorporating the fixed Skia version.

Workarounds

Restrict access to untrusted web content through enterprise browsing policies and URL categorization.
Enforce site isolation and disable non-essential graphics features on high-risk user groups until patching completes.
Use group policy or MDM to block execution of outdated Chrome versions on managed devices.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version