CVE-2026-79020: Google Chrome Skia Information Disclosure

CVE-2026-79020 Overview

CVE-2026-79020 is an out-of-bounds read vulnerability in the Skia graphics library used by Google Chrome. A remote attacker can trigger the flaw by delivering a crafted media file to a target browser. Successful exploitation allows the attacker to read memory inside the Chrome sandbox process. Google addressed the issue in Chrome 152.0.7977.65 on the Stable channel. Chromium classifies the security severity as Medium, and the weakness is tracked under CWE-125.

Critical Impact
A remote attacker who convinces a user to load a crafted media file can read memory contents from within the Chrome renderer sandbox, potentially exposing sensitive process data.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Skia graphics library as bundled with affected Chromium builds
Chromium-based browsers that embed the vulnerable Skia component

Discovery Timeline

2026-08-25 - CVE-2026-79020 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79020

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render images, media, and canvas content. Skia performs a read operation that exceeds the bounds of an allocated buffer when processing a specifically crafted media file. The out-of-bounds read exposes adjacent memory contents from within the Chrome renderer process.

Because the read occurs inside the sandboxed renderer, the attacker does not obtain direct code execution. The disclosed memory can still include sensitive process state, pointers useful for bypassing address space layout randomization (ASLR), or content from other web origins loaded in the same process. Attackers commonly chain this class of primitive with a second vulnerability to escape the sandbox.

Root Cause

The defect is an out-of-bounds read classified as [CWE-125]. It stems from insufficient boundary validation in Skia when parsing attacker-controlled input embedded in a media file. Skia dereferences memory outside the intended allocation, returning data that should not be accessible to the parsing routine.

Attack Vector

Exploitation is remote and requires user interaction limited to loading a page or resource that references the crafted media file. An attacker can host the payload on a controlled site, deliver it through an advertisement, or embed it in a third-party context. No authentication is required. Detailed proof-of-concept information is not publicly available, and Google restricts access to the underlying report on the Chromium Issue Tracker #514017820.

No verified code examples are available for this vulnerability. Refer to the Google Chrome Stable Update advisory for vendor-supplied context.

Detection Methods for CVE-2026-79020

Indicators of Compromise

Chrome renderer processes crashing or terminating unexpectedly while rendering media content from untrusted origins
Browser telemetry showing repeated GPU or renderer crashes correlated with specific hosts serving media files
Endpoint logs indicating Chrome versions older than 152.0.7977.65 still deployed after the vendor patch release

Detection Strategies

Inventory installed Chrome and Chromium-derivative browser versions across managed endpoints and flag builds below 152.0.7977.65
Correlate web proxy or DNS logs with browser crash reports to identify hosts serving suspicious media payloads
Enable Chrome crash reporting and forward chrome.exe and renderer crash events to a central log store for triage

Monitoring Recommendations

Ingest browser process telemetry, crash events, and version data into a central analytics platform to spot lagging endpoints
Monitor outbound HTTP responses containing anomalous or malformed image and media MIME types delivered to end users
Track vendor advisories from the Chrome release blog and Chromium issue tracker to align patch SLAs with disclosure timelines

How to Mitigate CVE-2026-79020

Immediate Actions Required

Update Google Chrome on all managed endpoints to version 152.0.7977.65 or later on the Stable channel
Patch Chromium-based browsers that embed Skia once their vendors ship a build incorporating the fix
Restart browser processes after the update so that the patched Skia library is loaded into memory

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. Upgrading to Chrome 152.0.7977.65 or later remediates the vulnerability. Enterprises using managed Chrome policies should verify that auto-update is enabled and that update rollout groups reach the patched version within their standard change window.

Workarounds

Restrict browsing of untrusted sites and disable auto-loading of media content where the browser configuration allows it
Use enterprise browser policies to enforce site isolation, which limits cross-origin data exposure from a single renderer
Deploy web content filtering to block known malicious hosts and reduce exposure to crafted media payloads until patching completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv