CVE-2026-78958: Google Chrome Skia Information Disclosure

CVE-2026-78958 Overview

CVE-2026-78958 is an uninitialized resource vulnerability [CWE-908] in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially obtain cross-origin data. Chromium classifies the security severity as Medium.

The vulnerability breaks the browser's same-origin isolation guarantees when combined with a prior renderer compromise. It expands the impact of an initial foothold rather than enabling first-stage code execution on its own.

Critical Impact
An attacker with an existing renderer compromise can read cross-origin data by rendering a crafted HTML page through Skia, undermining web origin boundaries.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Skia component
Applications relying on the Chromium rendering stack prior to the patched release

Discovery Timeline

2026-08-25 - CVE-2026-78958 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78958

Vulnerability Analysis

Skia is the 2D graphics library that backs Chrome's rendering pipeline, including canvas, WebGL fallbacks, and general compositing paths. The defect involves a resource that Skia allocates and uses without fully initializing its backing memory. When that resource is read back or reused during rendering, residual data from prior allocations can be exposed to script running in the renderer.

Because the affected code path handles cross-origin content during compositing, an attacker who controls the renderer process can influence which data ends up in the uninitialized region. A crafted HTML page then reads the results and exfiltrates them across the origin boundary. Chrome's sandbox does not mitigate this class of issue because the disclosure happens inside the compromised renderer itself.

Root Cause

The root cause is a use of uninitialized memory in Skia, categorized under CWE-908: Use of Uninitialized Resource. A graphics resource is placed into service before all of its bytes are set to a defined value, allowing whatever data previously occupied that memory to be observed through rendering results.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the Chrome renderer process, typically through a separate memory corruption or logic bug. Second, the attacker must serve or navigate the renderer to a crafted HTML page that exercises the vulnerable Skia code path. The rendered output or a readback API then leaks the uninitialized bytes, which may contain data from other origins loaded in the same process.

No public exploit or proof-of-concept has been published. Detailed technical information is tracked in Chromium Issue #497205529.

Detection Methods for CVE-2026-78958

Indicators of Compromise

Chrome browser processes running versions prior to 152.0.7977.65 in enterprise inventory scans
Renderer process crashes or anomalous GPU process behavior preceding suspicious network egress
Unexpected navigation to unfamiliar domains immediately followed by cross-origin data exfiltration patterns

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across managed endpoints and flag builds below 152.0.7977.65.
Correlate renderer crash telemetry with subsequent outbound HTTP POSTs containing large payloads to newly observed domains.
Hunt for browser child processes spawning unexpected utility processes, which may indicate an upstream renderer compromise chained with this bug.

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and alert on hosts that fall behind the stable channel.
Monitor DNS and proxy logs for connections to newly registered domains from browser processes.
Baseline Skia-related crash signatures reported through crash dump collection and investigate deviations.

How to Mitigate CVE-2026-78958

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed endpoints.
Force-restart Chrome after deployment so that patched binaries and the Skia library are loaded into memory.
Validate that Chromium-based browsers and embedded frameworks in the environment have consumed the corresponding Skia fix.

Patch Information

Google addressed CVE-2026-78958 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fix ships in Chrome 152.0.7977.65 and later. Chromium downstream projects should pick up the corresponding Skia commit referenced in Chromium Issue #497205529.

Workarounds

No vendor-supplied workaround exists; patching to the fixed Chrome build is the supported remediation.
Restrict browsing to trusted sites through enterprise URL allowlists until patches are deployed to reduce exposure to crafted HTML pages.
Enforce Site Isolation policies to limit the scope of cross-origin data reachable within any single renderer process.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux
google-chrome --version