CVE-2026-91740 Overview
CVE-2026-91740 is an uninitialized resource vulnerability in the Skia graphics library used by Google Chrome. The flaw exists in Chrome versions prior to 153.0.8010.47 and allows a remote attacker to obtain cross-origin data through a crafted HTML page. Google classified the underlying Chromium security severity as High, while the NVD assigns a medium base score reflecting limited confidentiality impact and required user interaction. The vulnerability maps to [CWE-908: Use of Uninitialized Resource]. Exploitation depends on convincing a user to visit an attacker-controlled page. No public proof-of-concept or in-the-wild exploitation has been reported.
Critical Impact
A remote attacker can read cross-origin data from another site by rendering a crafted HTML page in Chrome, breaking the same-origin policy that isolates web content.
Affected Products
- Google Chrome (Desktop) versions prior to 153.0.8010.47
- Chromium-based browsers using the vulnerable Skia component
- Embedded frameworks bundling pre-patch Chromium builds
Discovery Timeline
- 2026-09-15 - CVE-2026-91740 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91740
Vulnerability Analysis
Skia is the 2D graphics library that renders paths, text, and images inside Chrome. The vulnerability arises when Skia processes graphics operations using memory that was not fully initialized before use. Reading uninitialized memory can expose bytes left over from prior allocations, including data belonging to other origins.
Because the affected code path is reachable from web content, an attacker can craft HTML, CSS, or Canvas operations that trigger the uninitialized read. The leaked bytes can then be sampled through timing-independent channels such as pixel readback via getImageData or WebGL texture reads. The result is a same-origin policy bypass constrained to information disclosure.
The user interaction requirement in the CVSS vector reflects the need for a victim to load the malicious page. No elevated privileges are required on the target system.
Root Cause
The root cause is [CWE-908: Use of Uninitialized Resource] inside Skia. A buffer, texture, or intermediate rendering surface is consumed before all bytes have been written with defined values. The uninitialized region reflects residual heap or GPU memory, which may contain fragments of cross-origin responses, tokens, or DOM data previously handled by the renderer process.
Attack Vector
The attack vector is network-based and requires user interaction. A victim visits a page hosting the crafted graphics payload. The renderer invokes the vulnerable Skia code path, produces output derived from uninitialized memory, and returns pixel data to the attacker's JavaScript. The attacker exfiltrates the sampled bytes to a controlled endpoint. Technical specifics are tracked in the restricted Chromium Issue Tracker #553122373.
No public exploit code, Metasploit module, or Exploit-DB entry is available for this issue.
Detection Methods for CVE-2026-91740
Indicators of Compromise
- Browser telemetry showing Chrome or Chromium-based clients on versions earlier than 153.0.8010.47 accessing untrusted sites
- Outbound HTTP POST requests from renderer processes containing base64-encoded pixel or binary blobs to unfamiliar domains
- Web pages that combine <canvas>, WebGL, or SVG filter operations with rapid getImageData or readPixels sampling loops
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag builds below 153.0.8010.47
- Deploy web proxy or DNS filtering rules that log Canvas and WebGL heavy content from newly registered or low-reputation domains
- Correlate browser process network activity with sites that instantiate large numbers of offscreen canvases or WebGL contexts
Monitoring Recommendations
- Ingest browser version telemetry into your SIEM or data lake to maintain a continuous patch-compliance view
- Alert on Chrome renderer processes making unexpected outbound connections after visiting untrusted content
- Track user reports of unexpected browser rendering artifacts, which can accompany uninitialized memory reads
How to Mitigate CVE-2026-91740
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
- Restart browsers after applying the update so the patched Skia binary is loaded into memory
- Prioritize systems used to access sensitive web applications, such as identity providers and email
Patch Information
Google addressed the issue in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Vendors shipping Chromium-based browsers should incorporate the corresponding Skia fix. Enterprises managing browsers through Group Policy, Jamf, or Intune should confirm auto-update channels are enabled and not overridden.
Workarounds
- Disable hardware acceleration only if patching is temporarily blocked, understanding this does not fully eliminate the issue
- Restrict access to untrusted websites through enterprise web filtering while the patch is being deployed
- Apply strict Content Security Policy headers on internal applications to limit third-party script execution that could chain with this flaw
# Verify Chrome version on Linux endpoints
google-chrome --version
# Force update check via Chrome policy (Windows, elevated)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
