Executive brief
Google Chrome is a widely used web browser. A vulnerability in its Skia graphics engine could allow a remote attacker who has already compromised a browser's rendering process to bypass security boundaries and access data from other websites. This could lead to the unauthorized exposure of sensitive user information from different web sessions.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Skia graphics component of Google Chrome. The flaw allows a remote attacker to leak cross-origin data by enticing a user to visit a specially crafted HTML page. A precondition for this exploit is that the attacker must have already compromised the renderer process. By exploiting this insufficient validation, the attacker can bypass Same-Origin Policy (SOP) protections to access data from other origins. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome Stable Channel Update for Desktop released version 149.0.7827.53
- 2026-06-04: disclosed: CVE published to NVD