CVE-2026-79147 Overview
CVE-2026-79147 is an information disclosure vulnerability in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can obtain sensitive information through a crafted HTML page. Google's Chromium team rated the underlying issue as low security severity. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Attackers with an existing renderer compromise can leak sensitive process memory or graphics state, aiding sandbox escape chains and follow-on exploitation.
Affected Products
- Google Chrome Desktop versions prior to 152.0.7977.65
- Chromium-based browsers embedding the vulnerable Skia component
- Downstream distributions bundling pre-152 Chrome builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79147 published to the National Vulnerability Database
- 2026-08-26 - NVD record last modified
Technical Details for CVE-2026-79147
Vulnerability Analysis
The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render vector graphics, text, and canvas content. Skia processes rendering primitives inside the renderer process. The flaw allows an attacker who already controls that process to read data that should remain isolated. Exploitation requires user interaction, such as loading a crafted HTML page that triggers specific Skia rendering paths. Attack complexity is high because the attacker must first compromise the renderer through a separate primitive.
The leaked data can include pointer values, adjacent heap memory, or graphics state that supports address-space layout randomization (ASLR) bypass. Information leaks of this class typically serve as building blocks in multi-stage exploit chains rather than as standalone attacks.
Root Cause
The root cause is improper handling of memory or state within Skia rendering routines, classified under CWE-200. Skia returns or exposes data that the renderer sandbox intended to keep confidential. Public details from the vendor are limited; the Chromium Issue Tracker #513969378 contains the restricted technical record.
Attack Vector
An attacker must first achieve code execution or scripting control inside a Chrome renderer process. The attacker then serves a crafted HTML page that invokes the vulnerable Skia path. When the victim interacts with the page, Skia returns sensitive data readable by the compromised renderer. The attacker uses that data to defeat mitigations or pivot toward a sandbox escape. See the Chrome Desktop Update August 2026 advisory for release context.
No verified proof-of-concept code is publicly available. Refer to the vendor advisory for authoritative technical detail.
Detection Methods for CVE-2026-79147
Indicators of Compromise
- Chrome renderer processes generating unexpected crashes or memory read errors when parsing HTML canvas or SVG content
- Outbound network traffic from browser hosts containing encoded pointer-like or heap-shaped byte sequences
- Endpoints running Chrome builds earlier than 152.0.7977.65 after the patch release date
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any release below 152.0.7977.65
- Monitor for renderer process anomalies including unexpected child process spawns, memory access violations, or Skia-related crash signatures
- Correlate browser telemetry with web proxy logs to identify visits to pages that trigger renderer crashes
Monitoring Recommendations
- Track Chrome auto-update health and alert on hosts that fail to reach the patched build within your remediation window
- Ingest browser crash and stability telemetry into your SIEM or data lake for pattern analysis
- Alert on renderer process behavior that deviates from baseline, such as unusual memory read patterns or repeated tab crashes on specific origins
How to Mitigate CVE-2026-79147
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Force browser restart across the fleet to complete the patch application
- Audit Chromium-based browsers and Electron applications that embed Skia and apply vendor updates as available
Patch Information
Google released the fix in the Chrome Stable channel update documented in the Chrome Desktop Update August 2026 announcement. Install Chrome 152.0.7977.65 or later. Enterprise administrators should validate deployment through the Chrome Browser Cloud Management console or endpoint management tooling.
Workarounds
- Enforce Chrome auto-update through group policy or mobile device management to shorten patch windows
- Restrict browsing to trusted origins using enterprise policies until patching is complete
- Deploy site isolation and strict sandbox settings to raise the cost of the prerequisite renderer compromise
# Verify Chrome version on Linux endpoints
google-chrome --version
# Windows registry policy to enforce minimum version via update channel
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
# macOS: query installed Chrome build
mdls -name kMDItemVersion "/Applications/Google Chrome.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
