Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory… (CVE-2026-106399)

CVE-2026-106399 describes an out-of-bounds read in the Skia graphics library within Google Chrome versions before 155.0.8059.39. A local attacker could leverage social engineering to trick a user into opening a crafted file, which may result in reading memory beyond intended bounds. The vulnerability is rated low severity with a CVSS 3.1 score of 3.3, indicating limited impact confined to confidentiality with no integrity or availability effects.

The vulnerability allows a local attacker to potentially read sensitive memory contents by exploiting an out-of-bounds read in Skia. The impact is limited to confidentiality (partial information disclosure) without affecting integrity or availability. No known exploits are reported in the wild.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated.