CVE-2026-76041: Google Chrome Skia Information Disclosure

CVE-2026-76041 Overview

CVE-2026-76041 is an information disclosure vulnerability in the Skia graphics library used by Google Chrome. Versions prior to 151.0.7922.169 are affected. A remote attacker can leverage a crafted HTML page to leak information and potentially bypass the web origin policy. Google's Chromium security team rated this issue as High severity internally, though the NVD CVSS 3.1 score classifies it as Medium. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction, such as visiting a malicious website. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
A remote attacker can bypass same-origin restrictions and read cross-origin data rendered through Skia by luring a user to a crafted HTML page.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.169
Chromium-based browsers embedding the vulnerable Skia component
Applications bundling Chromium builds released before the fix

Discovery Timeline

2026-08-18 - CVE-2026-76041 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76041

Vulnerability Analysis

The flaw resides in Skia, the 2D graphics rendering engine that Chrome uses for canvas, image, and compositor operations. A crafted HTML page can trigger a code path in Skia that returns pixel or buffer data derived from cross-origin resources. The browser normally enforces same-origin restrictions on canvas readback and image data. This vulnerability circumvents those checks, allowing script running on the attacker's page to read data it should not access.

Because user interaction is required, the typical exploitation path involves social engineering a target to visit an attacker-controlled site. Once loaded, the malicious page renders cross-origin content, invokes the vulnerable Skia operation, and exfiltrates the leaked pixels or bytes. The leaked data can include content from authenticated third-party sessions, such as images or rendered documents behind login walls.

Root Cause

The root cause is improper enforcement of origin boundaries during Skia rendering or readback operations. Skia processes cross-origin resources without correctly propagating the tainted status to downstream buffers. The rendering engine then permits scripted access to those buffers, breaking the same-origin policy contract that isolates web content between origins.

Attack Vector

The attack vector is network based and requires user interaction. An attacker hosts a crafted HTML page that references cross-origin resources and invokes the vulnerable Skia code path. When a Chrome user visits the page, script on the page reads the leaked data and transmits it to an attacker-controlled endpoint. No authentication or elevated privileges are required on the target system.

See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for additional context on the affected component.

Detection Methods for CVE-2026-76041

Indicators of Compromise

Chrome browser process versions below 151.0.7922.169 observed in enterprise inventory data
Outbound HTTP or WebSocket traffic containing base64-encoded image or canvas data to unfamiliar domains
Web content that heavily instruments CanvasRenderingContext2D, getImageData, or WebGL readback APIs against cross-origin sources

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.169
Correlate browsing telemetry with threat intelligence feeds listing domains hosting exploit content for recent Chrome CVEs
Inspect proxy logs for anomalous data uploads from browser processes shortly after visits to newly registered domains

Monitoring Recommendations

Continuously monitor endpoint browser versions and enforce update compliance policies
Alert on Chrome child processes making unexpected outbound connections to low-reputation destinations
Track user reports of unusual browser prompts, redirects, or performance anomalies while browsing untrusted sites

How to Mitigate CVE-2026-76041

Immediate Actions Required

Update Google Chrome to version 151.0.7922.169 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched Skia library is loaded
Update embedded Chromium runtimes and Electron-based applications to builds incorporating the fix

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update. Administrators should deploy Chrome 151.0.7922.169 or later. Chromium downstream projects should rebase on the corresponding upstream commit referenced in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patches are deployed
Enable strict site isolation and third-party cookie restrictions to reduce the value of any leaked cross-origin data
Use enterprise policy to enforce automatic Chrome updates and prevent version rollback

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: query bundle version
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString