Executive brief
A vulnerability in Google Chrome's graphics engine could allow a malicious website to access sensitive data from other open websites or browser tabs. This occurs when the browser fails to properly clear memory before use, potentially exposing private user information to an attacker who has already partially compromised the browser's internal processes. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
An uninitialized use vulnerability (CWE-457) exists in the Skia graphics component of Google Chrome. The flaw is reachable by a remote attacker who has already compromised the renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can exploit this uninitialized state to leak sensitive cross-origin data. The vulnerability was addressed in Chrome version 150.0.7871.182 for Windows and Mac, and 150.0.7871.181 for Linux.
Affected products
- Google Chrome prior to 150.0.7871.182
Timeline
- 2026-06-08: disclosed: Reported by Google internal researchers
- 2026-07-21: patched: Fixed in Chrome Stable channel update 150.0.7871.182/181
- 2026-07-21: advisory