CVE-2026-79020: Out of bounds read in Google Chrome

This vulnerability involves an out-of-bounds read in the Skia graphics library used by Google Chrome versions before 152.0.7977.65. An attacker can craft a malicious media file that, when processed by Chrome, may cause the browser to read memory outside the intended bounds within the sandbox environment. This could lead to disclosure of sensitive information. The issue is tracked as CWE-125 (Out-of-bounds Read) and has been assigned CVE-2026-79020. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation could allow an attacker to read sensitive memory contents within the sandboxed environment of Chrome, potentially exposing confidential information. The vulnerability does not impact integrity but has high confidentiality and availability impacts. No known active exploitation has been reported.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side application vulnerability, applying the official update is the recommended mitigation.