CVE-2026-19160

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the disclosure of sensitive cross-origin data.

A moderate severity information disclosure flaw was found in Skia, the 2D graphics library used by Google Chrome and by WebKitGTK in Red Hat Enterprise Linux. An uninitialized memory use in Skia allows a remote attacker who has already compromised the browser's renderer process to leak cross-origin data when a user visits a crafted HTML page. Red Hat assessed this flaw as having moderate impact rather than upstream's High rating because exploitation requires the attacker to have already compromised the renderer process, so the flaw primarily enables information disclosure across the same-origin policy boundary rather than an initial compromise. In Red Hat Enterprise Linux 7, 8, and 9, the webkit2gtk3 and webkitgtk4 components that bundle Skia are affected, and fixes are being pursued through the upstream WebKitGTK project; Red Hat's Firefox and Thunderbird packages are not affected because the vulnerable code is not present in the Skia copies they ship. The chromium package in Fedora and EPEL (Community Projects) is also affected, with updates handled through the community channels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.