CVE-2026-78914
chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized resource in Skia
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 26, 2026
Updated · November 2, 2026
Description
A flaw was found in Skia, a 2D graphics library used in Chromium. A remote attacker could exploit an uninitialized resource vulnerability by tricking a user into opening a specially crafted HTML page. This could potentially allow the attacker to read sensitive memory within the browser's sandbox, leading to information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-824 · Access of Uninitialized Pointer