CVE-2026-79020

chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

An out‑of‑bounds read bug in Skia, the graphics library used by Google Chrome, permits a remote attacker to read portions of memory belonging to the sandboxed renderer when a crafted media file is processed. This flaw can expose confidential data or aid in further sandbox escape, compromising confidentiality and potentially integrity. The vulnerability is a memory disclosure caused by an out‑of‑bounds read (CWE‑125).

Affected Systems

Google Chrome 152.0.7977.64 and earlier desktop versions are affected. The issue was fixed in Chrome 152.0.7977.65, so any installation of an earlier version should be updated to the patched release.

Risk and Exploitability

The flaw is exploitable via a malicious media file, suggesting a drive‑by or email‑based attack vector. Exploitation would occur within the sandbox, making it useful for data exfiltration or as a stepping stone to other attacks. The CVSS score of 8.1 indicates a high severity level. EPSS score is less than 1%, suggesting a low probability of active exploitation, and the vulnerability is not listed in CISA's KEV catalog. Because the attack surface includes any user who opens a crafted file, administrators should treat this as an elevated risk until the patch is applied.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 152.0.7977.65 or newer on all affected systems.
  • Disable or restrict Skia‑rendered media handling via group policy or security settings to reduce the surface for crafted media files if an update cannot be applied immediately.
  • Keep monitoring Google Chrome release notes and security advisories for additional mitigations or related vulnerabilities.

Generated by OpenCVE AI on August 28, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
Debian DSA Debian DSA DSA-6534-1 webkit2gtk security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Skia Out-of-Bounds Read Allowing Memory Disclosure via Crafted Media File
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Skia Out-of-Bounds Read Allowing Memory Disclosure via Crafted Media File
Type Values Removed Values Added
Description Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium)
Weaknesses CWE-125
References
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 17, 2026, 6:52 PM
Reserved
Aug 25, 2026, 6:07 AM

View source JSON

Updated
Aug 28, 2026, 6:56 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:17 PM
Modified
Aug 31, 2026, 1:39 PM

View source JSON

Severity
Moderate
Public date
Aug 25, 2026, 8:10 PM

View source Bugzilla JSON

Updated
Aug 28, 2026, 11:00 PM

JSON