CVE-2026-7949: Google Chrome Information Disclosure Flaw

CVE-2026-7949 Overview

CVE-2026-7949 is an out-of-bounds read vulnerability in the Skia graphics library used by Google Chrome prior to version 148.0.7778.96. The flaw allows a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. Google classified the issue as Medium severity in its Chromium tracker, and the National Vulnerability Database scored it as Low. The vulnerability is tracked under [CWE-125] (Out-of-bounds Read) and affects Chrome installations on Windows, macOS, and Linux.

Critical Impact

Successful exploitation enables disclosure of cross-origin data from memory regions adjacent to Skia graphics buffers, undermining the same-origin policy in browsers running unpatched Chrome builds.

Affected Products

• Google Chrome versions prior to 148.0.7778.96
• Google Chrome on Microsoft Windows
• Google Chrome on Apple macOS and Linux

Discovery Timeline

• 2026-05-06 - CVE-2026-7949 published to the National Vulnerability Database
• 2026-05-07 - Last updated in the NVD database

Technical Details for CVE-2026-7949

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses for rasterization, canvas rendering, and compositing. Skia processes geometric primitives, paths, and image buffers on behalf of the renderer process. An out-of-bounds read in this component permits the renderer to access memory outside the bounds of an allocated graphics buffer.

Exploitation requires that the attacker first compromise the renderer process. From that position, the attacker uses a crafted Chrome Extension to trigger the boundary violation in Skia. The leaked bytes can include sensitive cross-origin content held in memory, breaking the renderer's process-level isolation guarantees.

The attack requires user interaction and has high attack complexity, which limits opportunistic exploitation. However, the vulnerability remains practical when chained with a separate renderer-compromise primitive that an attacker has already obtained.

Root Cause

The root cause is missing or insufficient bounds checking inside Skia code paths reachable from the renderer. When Skia operates on attacker-influenced geometry or image data, it reads beyond the intended buffer length. The CWE classification for this defect is [CWE-125], Out-of-bounds Read.

Attack Vector

The attack vector is network-based and proceeds in two stages. First, the attacker achieves code execution in the Chrome renderer process through an unrelated bug or a malicious page. Second, the attacker loads a crafted Chrome Extension that issues Skia operations designed to provoke the out-of-bounds read. The disclosed memory crosses origin boundaries, allowing theft of data the renderer would normally not be allowed to read.

No public proof-of-concept exploit, ExploitDB entry, or CISA Known Exploited Vulnerabilities listing exists for this issue at the time of publication. See the Chromium Issue Tracker Entry for technical details once Google removes access restrictions.

Detection Methods for CVE-2026-7949

Indicators of Compromise

• Installation of unsigned or sideloaded Chrome Extensions that request broad host permissions or access to chrome.tabs and DOM scraping APIs.
• Chrome renderer process crashes referencing Skia stack frames in browser crash reports.
• Outbound HTTPS traffic from extension service workers transmitting unexpected payloads to attacker-controlled hosts.

Detection Strategies

• Inventory installed Chrome Extensions across managed endpoints and flag any extension not present in the corporate allowlist or the Chrome Web Store.
• Correlate Chrome version telemetry with the fixed build 148.0.7778.96 to identify hosts running vulnerable binaries.
• Hunt for child process anomalies and unusual file or network activity originating from chrome.exe renderer instances.

Monitoring Recommendations

• Forward Chrome update status and extension inventory to the SIEM and alert on deviations from policy baselines.
• Monitor browser crash telemetry for repeated faults inside Skia modules, which may indicate exploitation attempts.
• Track extension installation events through enterprise browser management or endpoint telemetry to catch sideloading.

How to Mitigate CVE-2026-7949

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.96 or later on all Windows, macOS, and Linux endpoints.
• Restart Chrome after the update completes so the patched Skia library is loaded into all renderer processes.
• Audit installed extensions and remove any that are unsigned, unused, or not explicitly approved.

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Update Announcement. Enterprises managing Chrome through Group Policy or Chrome Browser Cloud Management should confirm that automatic updates are enabled and that the minimum version policy enforces 148.0.7778.96 or later.

Workarounds

• Enforce an extension allowlist via the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies until patching is complete.
• Disable developer mode in Chrome to prevent loading of unpacked extensions on managed devices.
• Restrict extension installation to administrators and require review of requested permissions before approval.

# Configuration example: enforce minimum Chrome version via policy on Linux
# /etc/opt/chrome/policies/managed/cve-2026-7949.json
{
  "TargetVersionPrefix": "148.0.7778.96",
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}