{"id":"CVE-2026-126922","kind":"vulnerability","aliases":["CVE-2026-126922"],"related":[],"title":"Chrome: Skia out-of-bounds read leaks cross-origin data from crafted pages","description":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome's Skia graphics library has an out-of-bounds read that a remote attacker who already controls the renderer process can use to leak cross-origin data. The attack is delivered through a crafted HTML page.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","endpoints","other"],"not_affected_if":["chrome-157.0.8103.78-or-later"],"how_to_check":"- Check the installed Chrome version in Chrome's About page or with `chrome://version`\n- Compare it against the fixed version `157.0.8103.78`","fix":"- Google Chrome: update to `157.0.8103.78` or later","status":"open","published_at":"2026-11-11T23:17:22+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","triaged_at":"2026-11-11T23:31:24+00:00","updated_at":"2026-11-11T23:31:24+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T23:31:24Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: update to `157.0.8103.78` or later","reach":"internet","title":"Chrome: Skia out-of-bounds read leaks cross-origin data from crafted pages","impact":"medium","summary":"Google Chrome's Skia graphics library has an out-of-bounds read that a remote attacker who already controls the renderer process can use to leak cross-origin data. The attack is delivered through a crafted HTML page.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","browsers","endpoints"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"cross-origin data from other sites leaks to the attacker","analyst_note":"","how_to_check":"- Check the installed Chrome version in Chrome's About page or with `chrome://version`\n- Compare it against the fixed version `157.0.8103.78`","plain_action":"Update Google Chrome to version 157.0.8103.78 or later through its built-in update check.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-157.0.8103.78-or-later"],"who_is_affected":"Desktop and mobile Chrome builds older than 157.0.8103.78 are affected. The attacker must first compromise the renderer process, so this is a chained exploit rather than a standalone bug. Teams that manage browsers can check their fleet version and skip this if Chrome auto-updates everywhere.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4535,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126922':18A,21A '-2026':17A,20A '157.0.8103.78':76C 'allow':77C 'alreadi':43B 'attack':41B,57B,80C 'bound':6A,36B,67C 'browser':22B 'chrome':1A,23B,26B,73C 'chromium':98C 'compromis':83C 'control':44B 'craft':14A,62B,95C 'cross':10A,53B,90C 'cross-origin':9A,52B,89C 'cve':16A,19A 'data':12A,55B,92C 'deliv':59B 'endpoint':24B 'googl':25B,72C 'graphic':29B 'high':101C 'html':63B,96C 'leak':8A,51B,88C 'librari':30B 'origin':11A,54B,91C 'out-of-bound':3A,33B 'page':15A,64B,97C 'prior':74C 'process':47B,86C 'read':7A,37B,68C 'remot':40B,79C 'render':46B,85C 'secur':99C 'sever':100C 'skia':2A,28B,70C 'use':49B 'via':93C","nicknames":[],"mitigations":[],"who_affected":"Desktop and mobile Chrome builds older than 157.0.8103.78 are affected. The attacker must first compromise the renderer process, so this is a chained exploit rather than a standalone bug. Teams that manage browsers can check their fleet version and skip this if Chrome auto-updates everywhere.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later through its built-in update check.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","endpoints","high","other"],"campaign_type":null,"search_a":"'-126922':18A,21A '-2026':17A,20A 'bound':6A 'chrome':1A 'craft':14A 'cross':10A 'cross-origin':9A 'cve':16A,19A 'data':12A 'leak':8A 'origin':11A 'out-of-bound':3A 'page':15A 'read':7A 'skia':2A","search_b":"'alreadi':43B 'attack':41B,57B 'bound':36B 'browser':22B 'chrome':23B,26B 'control':44B 'craft':62B 'cross':53B 'cross-origin':52B 'data':55B 'deliv':59B 'endpoint':24B 'googl':25B 'graphic':29B 'html':63B 'leak':51B 'librari':30B 'origin':54B 'out-of-bound':33B 'page':64B 'process':47B 'read':37B 'remot':40B 'render':46B 'skia':28B 'use':49B","search_c":"'157.0.8103.78':76C 'allow':77C 'attack':80C 'bound':67C 'chrome':73C 'chromium':98C 'compromis':83C 'craft':95C 'cross':90C 'cross-origin':89C 'data':92C 'googl':72C 'high':101C 'html':96C 'leak':88C 'origin':91C 'page':97C 'prior':74C 'process':86C 'read':68C 'remot':79C 'render':85C 'secur':99C 'sever':100C 'skia':70C 'via':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126922","severity":null,"published_at":"2026-11-11T23:17:22+00:00","modified_at":"2026-11-11T23:17:22+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","fetched_at":"2026-11-11T23:29:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}