{"id":"CVE-2026-126844","kind":"vulnerability","aliases":["CVE-2026-126844"],"related":[],"title":"Chrome: uninitialized Skia memory lets a compromised renderer read outside sandbox","description":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome's Skia graphics library reads an uninitialized resource, so a remote attacker who has already compromised the renderer process can read memory outside the sandbox via a crafted HTML page. Chromium rates the security severity as High.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","runtime"],"not_affected_if":["chrome-at-or-above-157.0.8103.78"],"how_to_check":"- Open Chrome's About page (`chrome://version`) and compare the version against `157.0.8103.78`\n- On managed fleets, check the installed Chrome version with your device management tool","fix":"- Google Chrome: move to `157.0.8103.78` or later","status":"open","published_at":"2026-11-11T23:17:12+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","triaged_at":"2026-11-11T23:33:47+00:00","updated_at":"2026-11-11T23:33:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T23:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.78` or later","reach":"internet","title":"Chrome: uninitialized Skia memory lets a compromised renderer read outside sandbox","impact":"medium","summary":"Google Chrome's Skia graphics library reads an uninitialized resource, so a remote attacker who has already compromised the renderer process can read memory outside the sandbox via a crafted HTML page. Chromium rates the security severity as High.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads memory outside the browser sandbox after renderer compromise","analyst_note":"","how_to_check":"- Open Chrome's About page (`chrome://version`) and compare the version against `157.0.8103.78`\n- On managed fleets, check the installed Chrome version with your device management tool","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Chrome menu > Help > About Google Chrome.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-at-or-above-157.0.8103.78"],"who_is_affected":"Any desktop browser running Chrome before 157.0.8103.78 is exposed to a crafted web page, but the attacker must first compromise the renderer process. Machines on managed fleets should be checked against the fixed version. Teams that do not use Chrome can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4538,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126844':14A,17A '-2026':13A,16A '157.0.8103.78':70C 'allow':71C 'alreadi':38B 'attack':35B,74C 'browser':18B 'chrome':1A,19B,23B,67C 'chromium':54B,92C 'compromis':7A,39B,77C 'craft':51B,89C 'cve':12A,15A 'desktop':20B 'googl':22B,66C 'graphic':26B 'high':60B,95C 'html':52B,90C 'let':5A 'librari':27B 'memori':4A,45B,83C 'outsid':10A,46B,84C 'page':53B,91C 'prior':68C 'process':42B,80C 'rate':55B 'read':9A,28B,44B,82C 'remot':34B,73C 'render':8A,41B,79C 'resourc':31B,62C 'runtim':21B 'sandbox':11A,48B,86C 'secur':57B,93C 'sever':58B,94C 'skia':3A,25B,64C 'uniniti':2A,30B,61C 'via':49B,87C","nicknames":[],"mitigations":[],"who_affected":"Any desktop browser running Chrome before 157.0.8103.78 is exposed to a crafted web page, but the attacker must first compromise the renderer process. Machines on managed fleets should be checked against the fixed version. Teams that do not use Chrome can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Chrome menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","high","runtime"],"campaign_type":null,"search_a":"'-126844':14A,17A '-2026':13A,16A 'chrome':1A 'compromis':7A 'cve':12A,15A 'let':5A 'memori':4A 'outsid':10A 'read':9A 'render':8A 'sandbox':11A 'skia':3A 'uniniti':2A","search_b":"'alreadi':38B 'attack':35B 'browser':18B 'chrome':19B,23B 'chromium':54B 'compromis':39B 'craft':51B 'desktop':20B 'googl':22B 'graphic':26B 'high':60B 'html':52B 'librari':27B 'memori':45B 'outsid':46B 'page':53B 'process':42B 'rate':55B 'read':28B,44B 'remot':34B 'render':41B 'resourc':31B 'runtim':21B 'sandbox':48B 'secur':57B 'sever':58B 'skia':25B 'uniniti':30B 'via':49B","search_c":"'157.0.8103.78':70C 'allow':71C 'attack':74C 'chrome':67C 'chromium':92C 'compromis':77C 'craft':89C 'googl':66C 'high':95C 'html':90C 'memori':83C 'outsid':84C 'page':91C 'prior':68C 'process':80C 'read':82C 'remot':73C 'render':79C 'resourc':62C 'sandbox':86C 'secur':93C 'sever':94C 'skia':64C 'uniniti':61C 'via':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126844","severity":null,"published_at":"2026-11-11T23:17:12+00:00","modified_at":"2026-11-11T23:17:12+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","fetched_at":"2026-11-11T23:29:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}