Executive brief
Google Chrome's Skia graphics rendering library contained an information leak vulnerability that could allow an attacker with control of the browser's rendering process to extract sensitive information from a user's device via a specially crafted webpage. This vulnerability could lead to exposure of sensitive data stored in the browser or system memory, affecting user privacy and potentially compromising confidential information.
Technical details
CVE-2026-79147 is an information leak vulnerability in Skia, Google Chrome's graphics rendering library. The vulnerability allows a remote attacker who has already compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. The attack requires prior compromise of the renderer process, meaning this is a post-exploitation vector rather than a direct remote code execution. The vulnerability was assigned a Chromium security severity of Low but a reported CVSS score of 5.3 (Medium). The fix was included in Chrome 152.0.7977.65 released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched