Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics engine, Skia, could allow a malicious website to access data from other websites you have open. This could lead to the unauthorized disclosure of sensitive information if a user visits a specially crafted web page.
Technical details
A vulnerability classified as 'Use of Uninitialized Variable' (CWE-457) exists in the Skia graphics component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to an uninitialized memory state that can be exploited to bypass cross-origin isolation. A remote, unauthenticated attacker can leverage this to leak sensitive data from different origins. The issue is resolved in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: NVD publication date.