Description
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Skia graphics library in Google Chrome contains a flaw in which untrusted input is not properly validated. When a malicious web page triggers the flaw, and the attacker has already gained control of the renderer process, the attacker can read arbitrary data from that process’s memory. The information exposed by this read can include sensitive data, and the vulnerability is identified as CWE‑20.

Affected Systems

All Chrome releases older than version 150.0.7871.46 that include the Skia library are affected. The bug is present in any operating system that runs Chrome on those releases.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level. An EPSS score of less than 1 % indicates a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw can only be exploited after the renderer process has been compromised; once that condition is satisfied, a crafted web page can trigger the memory read and disclose content.

Generated by OpenCVE AI on August 3, 2026 at 05:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 150.0.7871.46 or newer.
  • Enable automatic updates so that future security fixes are applied promptly.
  • Deploy the latest Chrome build across the enterprise using policy management to ensure all users run the patched version.

Generated by OpenCVE AI on August 3, 2026 at 05:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Mon, 03 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Skia Input Validation flaw allows memory disclosure after renderer compromise

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Skia Input Validation flaw allows memory disclosure after renderer compromise

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Skia Allows Remote Memory Read

Wed, 15 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Skia Allows Remote Memory Read

Tue, 14 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Skia Allows Renderer Memory Disclosure

Sun, 12 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Skia Allows Renderer Memory Disclosure

Sun, 12 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Error in Chrome Enables Renderer Memory Disclosure

Sat, 11 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Error in Chrome Enables Renderer Memory Disclosure

Fri, 10 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Failure Enables Memory Disclosure After Renderer Compromise in Chrome

Thu, 09 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Failure Enables Memory Disclosure After Renderer Compromise in Chrome

Wed, 08 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Failure Enabling Memory Read

Tue, 07 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Failure Enabling Memory Read

Tue, 07 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Flaw Allows Remote Renderer Memory Read

Mon, 06 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Flaw Allows Remote Renderer Memory Read

Sun, 05 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Untrusted Input in Skia Allows Memory Read After Renderer Compromise

Sun, 05 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title Untrusted Input in Skia Allows Memory Read After Renderer Compromise

Sat, 04 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Skia Leading to Process Memory Disclosure

Sat, 04 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation in Skia Leading to Process Memory Disclosure

Fri, 03 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Flaw Allows Memory Read via Crafted HTML Page in Google Chrome

Fri, 03 Jul 2026 04:15:00 +0000

Type Values Removed Values Added
Title Skia Input Validation Flaw Allows Memory Read via Crafted HTML Page in Google Chrome

Thu, 02 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Insufficient Validation of Untrusted Input in Skia Enabling Information Disclosure

Thu, 02 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Title Insufficient Validation of Untrusted Input in Skia Enabling Information Disclosure

Thu, 02 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 02 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T00:35:41.684Z

Reserved: 2026-07-01T21:37:31.694Z

Link: CVE-2026-14414

cve-icon Vulnrichment

Updated: 2026-07-02T00:35:37.933Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-01T23:16:49.863

Modified: 2026-07-02T16:13:37.357

Link: CVE-2026-14414

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T06:00:12Z

Weaknesses
  • CWE-20

    Improper Input Validation