Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-78958)

CVE-2026-78958 is an uninitialized resource vulnerability in the Skia graphics library used by Google Chrome before version 152.0.7977.65. An attacker who has compromised the renderer process could exploit this flaw to potentially obtain cross-origin data via a specially crafted HTML page. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource). The CVSS 3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact.

The impact is limited to potential unauthorized disclosure of cross-origin data if the attacker has already compromised the renderer process. There is no indication of integrity or availability impact. The severity is low, reflecting the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor official Google Chrome security advisories for updates and apply patches once available.