---
id: "CVE-2026-126848"
page: "https://infrastack.ai/live/CVE-2026-126848"
kind: "vulnerability"
aliases: ["CVE-2026-126848"]
title: "Chrome: Skia uninitialized resource lets a compromised renderer read memory"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chrome", "chromium", "desktop-browsers", "package"]
not_affected_if: ["chrome-fixed-version"]
published_at: "2026-11-11T23:17:12+00:00"
first_seen_at: "2026-11-11T23:29:36+00:00"
updated_at: "2026-11-11T23:33:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126848", "first_seen_at": "2026-11-11T23:29:36+00:00"}]
exploit_sources: []
---

# Chrome: Skia uninitialized resource lets a compromised renderer read memory

Link for people: https://infrastack.ai/live/CVE-2026-126848 (this .md is for agents)

Google Chrome's Skia graphics library reads an uninitialized resource, which lets an attacker who has already compromised the renderer process read memory outside the sandbox. The attack is delivered through a crafted HTML page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chrome version at chrome://version and compare it with `157.0.8103.78`

## Fix

- Google Chrome: move to `157.0.8103.78` or later

## Timeline

- 2026-11-11T23:29:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126848

## From the sources

Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_