CVE-2026-84359 Overview
CVE-2026-84359 is an information disclosure vulnerability in the Skia graphics library used by Google Chrome versions prior to 152.0.7977.75. A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page to the victim. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium engineers rated the internal severity as High, though the public CVSS score reflects the requirement for a pre-compromised renderer and user interaction.
Critical Impact
Successful exploitation enables an attacker to bypass the same-origin policy and exfiltrate cross-origin content rendered through Skia, defeating a core browser isolation boundary.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.75
- Chromium-based browsers embedding the vulnerable Skia component
- Any downstream distribution that had not yet integrated the Stable Channel update
Discovery Timeline
- 2026-09-02 - CVE-2026-84359 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84359
Vulnerability Analysis
The vulnerability resides in Skia, the 2D graphics library that Chrome uses to rasterize web content, canvas operations, and image data. The defect allows a compromised renderer process to read graphics data that originated from a different origin. This breaks the site isolation and same-origin guarantees that the browser architecture is designed to enforce.
Exploitation requires the attacker to first gain code execution inside the renderer, typically by chaining this issue with a separate renderer bug. The attacker then delivers a crafted HTML page that induces Skia into processing or exposing cross-origin pixel data. Because the flaw is an information leak rather than a memory corruption primitive, it is most useful as one link in a multi-stage exploit chain targeting sensitive rendered content.
Root Cause
The root cause is improper isolation of graphics data across origins within Skia [CWE-200]. Skia does not adequately restrict access to data buffers that should remain confined to a single security principal, allowing a compromised renderer to observe pixels or metadata belonging to another origin.
Attack Vector
The attack vector is network-based and requires user interaction: the victim must load a crafted HTML page under attacker influence. The attacker must additionally hold code execution inside the renderer sandbox before the leak can be triggered. No verified public proof-of-concept exists at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is publicly available. Refer to the Chromium Issue Tracker #514078656 for technical details once access restrictions are lifted.
Detection Methods for CVE-2026-84359
Indicators of Compromise
- Chrome or Chromium browser processes running versions earlier than 152.0.7977.75 on managed endpoints.
- Renderer processes exhibiting anomalous crashes, unexpected memory allocations, or unusual GPU command submissions preceding suspicious network egress.
- Outbound requests from browser sessions containing base64-encoded image or canvas data to untrusted domains.
Detection Strategies
- Inventory installed browser versions across the fleet and flag any Chrome build older than 152.0.7977.75.
- Correlate renderer process anomalies with subsequent network activity that could indicate exfiltration of leaked cross-origin data.
- Monitor for exploitation chains: this bug requires a prior renderer compromise, so identifications of preceding renderer exploitation are the primary trigger.
Monitoring Recommendations
- Ingest browser telemetry and process events into a centralized data lake to enable retroactive hunting once patch status is validated.
- Alert on browser child processes spawning unexpected children or performing file writes outside standard cache directories.
- Track DNS and HTTP telemetry for Chrome sessions communicating with newly registered or low-reputation domains.
How to Mitigate CVE-2026-84359
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints.
- Enforce automatic browser updates through group policy or mobile device management to prevent version drift.
- Restart browser sessions after the patch is deployed to ensure the vulnerable Skia code is unloaded from memory.
Patch Information
Google addressed the issue in the Stable Channel release 152.0.7977.75. Release notes are available in the Google Chrome Stable Update announcement. Chromium-based browser vendors should integrate the corresponding Skia fix and ship an equivalent update to their users.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering until patching is complete, reducing the likelihood of encountering a crafted HTML page.
- Enable strict site isolation and disable non-essential renderer features that expose Skia to untrusted content where operationally feasible.
- Deploy browser security policies that block execution of untrusted extensions capable of assisting in renderer compromise.
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Force policy-based automatic updates (Windows, admin PowerShell)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Update" -Name "UpdateDefault" -Value 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
