Executive brief
A vulnerability in Google Chrome's graphics engine could allow a malicious website to access sensitive information from the browser's memory. This issue occurs if an attacker has already partially compromised the browser's rendering process, potentially leading to the exposure of private user data. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
An uninitialized use vulnerability (CWE-457) exists in the Skia graphics component of Google Chrome. A remote attacker who has already compromised the renderer process can exploit this flaw via a specially crafted HTML page to read potentially sensitive information from the process memory. This vulnerability requires the attacker to have an initial foothold in the renderer process to execute the exploit. The issue was addressed in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published.