CVE-2026-78914: Google Chrome Information Disclosure Flaw

CVE-2026-78914 Overview

CVE-2026-78914 is an uninitialized resource vulnerability in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and enables a remote attacker to potentially read memory inside the sandbox through a crafted HTML page. Google classifies the Chromium security severity as Low, though the assigned CVSS score reflects confidentiality impact from cross-origin memory disclosure. The vulnerability is tracked under CWE-908: Use of Uninitialized Resource.

Critical Impact
A remote attacker can trigger memory disclosure inside the Chrome renderer sandbox by luring a user to a crafted web page, potentially exposing sensitive process memory.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Skia component
Desktop Chrome Stable channel builds preceding the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-78914 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78914

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render canvas elements, images, and other visual content. Skia allocates internal graphics resources during rendering operations. In the affected code path, one such resource is used before being fully initialized. When Chrome subsequently reads from this uninitialized memory, contents left over from prior allocations can be exposed to script running in the renderer process. An attacker who controls page content can shape allocations to influence which residual data appears in the uninitialized region. The observable memory sits inside the renderer sandbox, but that scope still includes cross-origin data, cached resources, and other sensitive process state.

Root Cause

The root cause is improper initialization of a Skia resource, mapped to CWE-908: Use of Uninitialized Resource. The affected allocation path does not zero-fill or otherwise deterministically populate the buffer before rendering consumes it, allowing prior heap contents to leak through graphics output surfaces or readback APIs exposed to JavaScript.

Attack Vector

Exploitation requires a network-reachable web page and user interaction to visit the attacker-controlled site. The attacker delivers a crafted HTML page that invokes specific Skia rendering paths through canvas, WebGL, or image decoding APIs. The page then reads back pixel or buffer data using standard web APIs to observe the uninitialized memory contents. No privileged access or additional user consent is required beyond loading the page. Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor technical context.

Detection Methods for CVE-2026-78914

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints
Outbound connections to unknown domains immediately followed by anomalous canvas or WebGL activity in browser telemetry
Web page requests containing unusual patterns of canvas getImageData or WebGL readPixels calls against many small draw regions

Detection Strategies

Inventory installed browser versions across the fleet and flag any Chrome build older than 152.0.7977.65 as vulnerable
Correlate browser process telemetry with DNS and proxy logs to identify visits to newly registered or low-reputation domains delivering heavy graphics workloads
Monitor endpoint detection and response telemetry for renderer processes making repeated small allocations followed by high-volume pixel readback

Monitoring Recommendations

Ingest browser version and update-channel data into the SIEM to maintain continuous exposure visibility
Alert on Chrome update failures or stalled patch deployments on endpoints reporting to management consoles
Track threat intelligence feeds for public proof-of-concept code targeting Skia uninitialized-memory issues

How to Mitigate CVE-2026-78914

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update installs to ensure the patched Skia component is loaded into all renderer processes
Push the update through enterprise browser management policies rather than relying on user-initiated updates

Patch Information

Google fixed the issue in the Chrome Stable channel release 152.0.7977.65. Deployment details are available in the Google Chrome Stable Update advisory. Downstream Chromium-based browsers should apply their vendor's corresponding update once the Skia fix has been merged.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching completes
Disable hardware acceleration only if compensating controls are required and patch rollout is delayed, recognizing this does not fully remove the code path
Enforce site isolation and strict cross-origin policies to limit the value of any memory an attacker can observe

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows registry policy to force auto-update (example)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f