CVE-2026-79147: Information leak in Google Chrome

This vulnerability involves an information leak in the Skia graphics library used by Google Chrome. Specifically, versions before 152.0.7977.65 are affected. An attacker who has already compromised the renderer process can exploit this flaw by delivering a crafted HTML page to extract sensitive information. The CVSS score of 5.3 reflects a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact but no integrity or availability impact. The vendor has released a stable channel update that addresses this issue.

An attacker who has compromised the renderer process can leverage this vulnerability to obtain sensitive information from the affected Chrome browser. The impact is limited to confidentiality as there is no integrity or availability impact. The attack requires user interaction and has high attack complexity, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild at this time.

Users should update Google Chrome to version 152.0.7977.65 or later to remediate this vulnerability. The vendor advisory confirms that this update includes the fix. No additional mitigation steps are indicated.