CVE-2026-79144: Google Chrome Skia Information Disclosure

CVE-2026-79144 Overview

CVE-2026-79144 is an information disclosure vulnerability in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to obtain cross-origin data through a crafted HTML page. Google Chromium rates the security severity as Medium. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction, such as visiting a malicious website, and the attacker gains read access to data that the same-origin policy should have isolated.

Critical Impact
A remote attacker can read cross-origin pixel or graphics data from another site by tricking a user into loading a crafted HTML page, bypassing browser origin isolation.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Skia graphics library as shipped in affected Chrome builds
Chromium-based browsers embedding the same vulnerable Skia code

Discovery Timeline

2026-08-25 - CVE-2026-79144 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79144

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render Canvas, WebGL, and general page content. Skia processes image data, shaders, and drawing commands that originate from untrusted web pages. In this case, Skia mishandles graphics data in a way that lets rendered output from one origin become observable to script running in another origin.

Because the leak occurs inside a shared rendering component, the same-origin policy enforcement performed by the browser layer above does not prevent the disclosure. An attacker can construct an HTML page that instructs the browser to render or sample content associated with a victim origin and then read residual or improperly isolated pixel data. The disclosed data is limited in scope, which aligns with the assigned severity and the low confidentiality impact indicated in the vector.

Root Cause

The root cause is improper isolation of cross-origin graphics data within Skia rendering paths. Under [CWE-200], sensitive information that should remain restricted to its origin becomes accessible to script that has no legitimate access. Google has not published detailed root cause analysis, and the underlying Chromium tracker at Chromium Issue #501759192 remains restricted.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must load a page controlled by the attacker or a page that includes attacker-controlled content, such as through a compromised advertisement or embedded frame. The crafted page issues rendering, drawing, or readback operations that cause Skia to expose data associated with a different origin. No authentication is required and the attacker does not need existing privileges on the target system.

No verified public proof of concept is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported. See the Google Chrome Desktop Update for the vendor advisory.

Detection Methods for CVE-2026-79144

Indicators of Compromise

Browser process telemetry showing Chrome versions below 152.0.7977.65 connecting to untrusted or newly registered domains hosting HTML pages with heavy Canvas, WebGL, or image-decoding activity.
Cross-origin resource requests from suspicious pages that immediately precede unusual readback operations on <canvas> elements or WebGL framebuffers.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any instance below 152.0.7977.65 as vulnerable.
Correlate browser version data with web proxy logs to identify vulnerable clients that visited untrusted external sites.
Monitor endpoint logs for browser crashes or renderer sandbox faults in Skia components, which can accompany exploitation attempts.

Monitoring Recommendations

Ingest browser version and patch-level telemetry into a central data platform to track exposure over time.
Alert on outbound connections from outdated Chrome installations to low-reputation domains.
Track user reports of unexpected content rendering, image artifacts, or cross-site data appearing in web applications.

How to Mitigate CVE-2026-79144

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force-restart Chrome after deployment so the patched Skia library loads into all renderer processes.
Update Chromium-based browsers, such as Microsoft Edge, Brave, and Opera, once vendors publish builds that incorporate the fixed Skia code.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update announced in the Google Chrome Desktop Update. Users should upgrade to Chrome 152.0.7977.65 or later. The underlying Chromium bug is tracked in Chromium Issue #501759192, which remains access-restricted pending broader patch adoption.

Workarounds

Restrict browsing on unpatched systems to trusted internal applications until the Chrome update is deployed.
Enforce enterprise policies that block execution of Chrome versions below 152.0.7977.65 through application control tooling.
Use content filtering to reduce exposure to unknown external sites that could serve crafted HTML.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion