CVE-2026-19161

A flaw was found in Skia in Google Chrome. This uninitialized use vulnerability allows a remote attacker, who has already compromised the renderer process, to craft a malicious HTML page. Successful exploitation can lead to the leakage of sensitive cross-origin data.

A flaw of important impact was found in Skia, the graphics library used by Chromium and bundled in WebKit-based rendering engines. Uninitialized memory use in Skia allows a remote attacker who has already compromised the renderer process to leak sensitive cross-origin data when the victim views a crafted HTML page, bypassing the same-origin policy and exposing confidential data across origins. In Red Hat Enterprise Linux the flaw is reachable through the webkit2gtk3 component, and a fix is being pursued for the affected streams. Firefox in Red Hat Enterprise Linux is not affected because the vulnerable code is not in the execute path, and Thunderbird and the webkitgtk4 package in Red Hat Enterprise Linux 7 are not affected because the vulnerable code is not present. The community-maintained chromium and webkitgtk packages in Fedora and EPEL are also affected, and fixes are pursued through those channels. Red Hat rated this flaw Important (CVSS 7.4), which is consistent with the upstream Chromium severity of High; CISA assigned a lower CVSS score (3.1, Low), reflecting high attack complexity, low confidentiality impact, and unchanged scope in its vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.