CVE-2026-6364: Google Chrome Skia Info Disclosure Flaw

CVE-2026-6364 Overview

CVE-2026-6364 is an out-of-bounds read vulnerability in the Skia graphics library used by Google Chrome. This memory corruption flaw allows a remote attacker to potentially extract sensitive information from process memory by delivering a specially crafted file to a victim's browser. The vulnerability affects all versions of Google Chrome prior to 147.0.7727.101.

Critical Impact

Remote attackers can exploit this flaw to leak sensitive information from Chrome's process memory, potentially exposing authentication tokens, session data, or other confidential information processed by the browser.

Affected Products

• Google Chrome prior to version 147.0.7727.101
• Chromium-based browsers using vulnerable Skia library versions
• Desktop platforms running affected Chrome versions

Discovery Timeline

• 2026-04-15 - CVE-2026-6364 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-6364

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety issue where the Skia graphics rendering library reads data beyond the boundaries of an allocated memory buffer. Skia is a critical 2D graphics library that Chrome uses for rendering web content, making it a high-value target for exploitation.

The out-of-bounds read occurs when Skia processes malformed graphics data, allowing an attacker to read memory locations that should not be accessible. This type of vulnerability can expose sensitive information that resides in adjacent memory regions, including heap metadata, object pointers, or user data being processed by the browser.

Root Cause

The root cause of CVE-2026-6364 lies in insufficient bounds checking within the Skia library when parsing or rendering graphical content. When processing a crafted file, the library fails to properly validate input parameters or buffer sizes before performing memory read operations, resulting in access to memory outside the intended buffer boundaries.

Attack Vector

The attack requires user interaction—specifically, the victim must be enticed to open a malicious file or visit a webpage containing the crafted content. The attacker delivers the exploit via a specially crafted file that, when processed by Chrome's Skia rendering engine, triggers the out-of-bounds read condition.

The vulnerability is network-exploitable, meaning attackers can host malicious content on web servers or deliver it through email attachments. When a user opens the malicious content in an affected Chrome version, the browser's rendering pipeline processes the file, triggering the memory disclosure vulnerability.

The vulnerability mechanism involves the Skia library's image or graphics processing functions failing to validate buffer boundaries. When parsing specific file structures, the library may calculate incorrect offsets or sizes, causing it to read beyond allocated memory regions. For detailed technical analysis, refer to the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-6364

Indicators of Compromise

• Chrome processes exhibiting unusual memory access patterns or crashes related to Skia rendering operations
• Suspicious image or graphics files with malformed headers or structures being served to users
• Network traffic containing crafted files targeting Chrome's graphics rendering engine
• Browser crash reports indicating out-of-bounds access in Skia-related components

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions capable of monitoring Chrome process behavior for anomalous memory access patterns
• Implement network-level inspection to identify and block delivery of known exploit payloads targeting Skia
• Monitor Chrome crash telemetry for patterns indicating exploitation attempts
• Use browser security telemetry to track rendering engine errors and potential exploitation indicators

Monitoring Recommendations

• Enable enhanced Chrome security logging to capture rendering engine errors and crashes
• Configure SentinelOne Singularity Platform to monitor Chrome process memory access patterns for exploitation indicators
• Set up alerts for Chrome processes accessing memory regions outside expected bounds
• Monitor web traffic for delivery of potentially malicious image or graphics files

How to Mitigate CVE-2026-6364

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.101 or later immediately across all endpoints
• Enable automatic Chrome updates to ensure timely deployment of future security patches
• Audit enterprise environments for Chrome versions prior to 147.0.7727.101 and prioritize remediation
• Consider implementing browser isolation technologies to contain potential exploitation attempts

Patch Information

Google has addressed this vulnerability in Chrome version 147.0.7727.101. The fix includes proper bounds checking in the affected Skia code paths to prevent out-of-bounds memory reads. For detailed patch information, refer to the Google Chrome Desktop Update.

Organizations should prioritize updating all Chrome installations and verify deployment through endpoint management tools. The SentinelOne Singularity Platform can assist in identifying vulnerable Chrome versions across the enterprise.

Workarounds

• Implement strict content filtering to block potentially malicious image and graphics files at the network perimeter
• Configure Chrome policies to restrict processing of untrusted file types where feasible
• Deploy browser isolation solutions to execute untrusted content in sandboxed environments
• Educate users about the risks of opening files from untrusted sources

# Verify Chrome version on endpoints
google-chrome --version

# For enterprise deployments, use group policy to enforce minimum version
# Chrome Enterprise Policy: BrowserMinVersion
# Set value: 147.0.7727.101 or higher

# Enable automatic updates via registry (Windows)
# HKLM\SOFTWARE\Policies\Google\Update
# Set: UpdateDefault = 1 (Always allow updates)