CVE-2026-17992: Google Chrome Skia Information Disclosure

CVE-2026-17992 Overview

CVE-2026-17992 is an uninitialized memory use vulnerability [CWE-457] in the Skia graphics library used by Google Chrome on Windows. Versions prior to 151.0.7922.72 are affected. A remote attacker can exploit the flaw by serving a crafted HTML page to a target browser. Successful exploitation allows the attacker to read potentially sensitive information from Chrome process memory. Google's Chromium security team rated the issue Low severity. The vulnerability affects the rendering pipeline where Skia processes graphics primitives, making standard web browsing an attack surface for information disclosure.

Critical Impact
Remote attackers can leak sensitive data from Chrome process memory through a crafted HTML page rendered by the Skia graphics engine.

Affected Products

Google Chrome on Windows prior to 151.0.7922.72
Applications embedding the affected Skia library versions
Chromium-based browsers on Windows shipping the vulnerable Skia code

Discovery Timeline

2026-07-30 - CVE-2026-17992 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17992

Vulnerability Analysis

The vulnerability is classified as Use of Uninitialized Variable [CWE-457] within Skia, Chrome's 2D graphics library. Skia handles rendering operations for HTML, CSS, Canvas, and image decoding paths. When Skia processes specific graphics operations, a code path reads memory before it has been initialized with a defined value. The uninitialized memory may contain residual data from previous allocations within the Chrome renderer or GPU process. An attacker who controls the graphics content being rendered can indirectly observe this memory through side effects such as pixel values, timing, or subsequent JavaScript reads via Canvas APIs. This class of bug typically enables information disclosure rather than direct code execution, but leaked pointers or tokens can support broader exploit chains against sandboxed browser processes.

Root Cause

The root cause is a missing initialization step in a Skia code path on Windows. A variable, buffer, or structure field is used before being assigned a defined value, exposing whatever data previously occupied that memory region. The fix in Chrome 151.0.7922.72 corrects the initialization logic in the affected Skia routine.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build. The attacker embeds specific graphics markup or Canvas operations that trigger the vulnerable Skia code path. No authentication or user interaction beyond page navigation is required. Details of the specific Skia function are restricted in the Chromium Issue Tracker Entry until sufficient users have updated.

No verified proof-of-concept code is available. See the Google Chrome Stable Update advisory for release details.

Detection Methods for CVE-2026-17992

Indicators of Compromise

Chrome browser processes on Windows running versions below 151.0.7922.72
Web traffic delivering HTML pages with anomalous Canvas, SVG, or WebGL payloads targeting Skia rendering paths
Unexpected memory read patterns or crashes in chrome.exe renderer or GPU processes

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag builds prior to 151.0.7922.72
Monitor endpoint telemetry for Chrome renderer or GPU process crashes correlated with untrusted web content
Use web proxy or DNS logs to identify traffic to domains delivering suspicious rendering-heavy content

Monitoring Recommendations

Track browser version compliance through endpoint management and asset inventory tooling
Correlate Chrome crash telemetry with URL browsing history to identify potential exploitation attempts
Alert on outbound connections from browser child processes to uncommon destinations following rendering activity

How to Mitigate CVE-2026-17992

Immediate Actions Required

Update Google Chrome on Windows to version 151.0.7922.72 or later
Restart Chrome after the update to ensure the patched Skia library is loaded
Verify auto-update is enabled and functioning across managed Windows endpoints
Update Chromium-based browsers and embedded Chromium components once vendors ship the fixed Skia code

Patch Information

Google released the fix in the Chrome Stable channel version 151.0.7922.72 for Windows. Deployment details are published in the Google Chrome Stable Update release notes. Enterprises using Chrome Browser Cloud Management or group policy should push the update through existing channels.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patching is complete
Enable strict site isolation and sandboxing policies in Chrome to limit information disclosure impact
Deploy web content filtering to block untrusted rendering-heavy pages on unpatched systems

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome update via group policy refresh
gpupdate /force