CVE-2026-10985: Out-of-Bounds Read in Google Chrome Skia – Data Leakage Vulnerability

Technical summary

CVE-2026-10985 is an out-of-bounds read vulnerability in the Skia graphics library integrated into Chromium. The flaw permits a remote, unauthenticated attacker to trigger an out-of-bounds memory read via a specially crafted HTML document. The vulnerability allows leakage of cross-origin data, violating the same-origin policy that normally isolates web content. The Chromium project rated this as High severity; the resulting CVSS score reflects the confidentiality impact while accounting for the requirement of user interaction.

Business impact

This vulnerability puts users at risk of credential theft, session hijacking, or exposure of sensitive information viewed in other browser tabs. Organizations should expect increased phishing and social engineering campaigns designed to trick users into visiting malicious sites. Data breaches affecting customers or employees could result in regulatory fines, reputational damage, and incident response costs. For businesses relying on Chrome as their standard browser, patch delays amplify exposure across the workforce.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. The Skia library is embedded in Chromium-based browsers, so other browsers built on Chromium (Edge, Brave, Opera, etc.) may also be affected; users should consult those vendors' advisories for specific version guidance. Desktop, mobile, and sync scenarios all present risk vectors.

Exploitability

Exploitation requires a victim to visit an attacker-controlled or compromised website. The attack is remotely deliverable with no privilege escalation required. While user interaction is necessary, the bar is low—a simple visit suffices. No special browser settings or prior compromise is needed. The accessibility of web-based exploitation makes this threat credible in the wild, though no evidence of active exploitation appears in public advisories at time of publication.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Browser auto-update should handle deployment, but verify completion across your fleet. If your organization uses Chromium-based alternatives (Edge, Brave, Opera), patch those browsers to the corresponding patched versions released by their respective vendors. Test patched versions in a non-production environment first if you maintain custom configurations or extensions.

Patch guidance

Google Chrome will auto-update to the patched version; however, users should manually check Settings > About Chrome to force an immediate check and restart. Organizations using managed browser deployments should consult their MDM or configuration management system to confirm the update policy targets version 149.0.7827.53 or later. Verify successful patching by confirming the version string in chrome://version/ matches or exceeds the fixed release. For Chromium-based browsers from other vendors, consult their official security advisories to obtain the equivalent patched version.

Detection guidance

Monitor Chrome version telemetry and browser inventory tools to identify systems still running versions before 149.0.7827.53. Check MDM logs for failed or delayed updates. Network-based detection of attacks is difficult because the malicious HTML is delivered over standard HTTPS; focus on endpoint telemetry and crash dumps if available. Monitor for unusual memory access patterns or GPU-related errors in browser crash reports, though these are not reliable indicators. User reports of unexpected data leaks or cross-site anomalies may signal exploitation attempts.

Why prioritize this

Although rated MEDIUM by CVSS, the ease of exploitation, cross-origin data leakage impact, and prevalence of Chrome in the workforce justify urgent patching. The low bar for user interaction and the confidentiality-only impact (no code execution) align with a measured but swift response—not emergency-level, but high in the monthly patch cycle. Organizations should treat this as a priority patch to complete within 7–14 days.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with low complexity and no privilege required, offset by the requirement for user interaction and the absence of integrity or availability impact. The High confidentiality rating captures the cross-origin data leakage. Real-world risk is elevated by Chrome's ubiquity, making this a common attack surface for threat actors seeking to steal credentials or session tokens.

Frequently asked questions