CVE-2026-11159: Chrome Skia Memory Leak Cross-Origin Data Exposure

Technical summary

CVE-2026-11159 is an uninitialized variable vulnerability (CWE-457) in Skia, Google's open-source 2D graphics library used by Chromium. When Skia processes certain graphics operations in a crafted HTML page, uninitialized memory may be read and exposed to JavaScript, enabling exfiltration of sensitive data across security boundaries. The vulnerability has a CVSS 3.1 score of 4.3 (Medium) with a network-based attack vector, low complexity, no privilege requirements, and user interaction needed. The impact is confidentiality loss without integrity or availability consequences.

Business impact

While the CVSS score is moderate, this vulnerability poses a real privacy risk in enterprise environments. An attacker could harvest credential previews, session tokens, or personally identifiable information from users browsing sensitive internal or third-party sites. The requirement for user interaction (visiting a malicious page) makes it suitable for targeted phishing or watering-hole campaigns against specific organizations. For businesses with strict data protection obligations (GDPR, HIPAA, SOC 2), any cross-origin data leak represents a compliance concern and potential incident notification requirement.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability also impacts Chromium-based browsers on multiple platforms: Apple macOS, Linux systems (including those running the Linux kernel), and Microsoft Windows. Organizations should audit all Chromium-derived browsers in their environments, including Brave, Edge, Opera, and others that inherit Chromium code.

Exploitability

Exploitability is moderate. An attacker must craft a specific HTML page and convince or trick a user into visiting it—no drive-by download or zero-click mechanism is involved. Once a user views the page, the uninitialized memory leak occurs automatically without further user action. The attack is deterministic given the right conditions, making it reliable for targeted campaigns. No public exploit code or weaponized POC is known to be widely available, but the simplicity of the underlying flaw (uninitialized variable) suggests reproduction and exploitation are straightforward for a competent attacker.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. For users of Chromium-based browsers (Edge, Brave, etc.), verify patch availability from the respective vendor—timelines may vary. macOS users should ensure Chrome auto-updates are enabled or manually trigger an update. Linux users should update via their distribution's package manager or download the latest stable build from Google. No workarounds short of avoiding untrusted websites exist.

Patch guidance

Deploy Chrome 149.0.7827.53 or later across your organization. If you manage Chromium-based browsers, confirm patch versions with each vendor's security advisory. Enable auto-update if not already active. Test the update in a small pilot group to verify no compatibility issues with internal web applications, then roll out broadly. For managed deployments (Windows domain, macOS MDM), use your device management platform to enforce the minimum version. Verify patching completion within 30 days of availability.

Detection guidance

Monitor Chrome version telemetry in your endpoint management system for machines still running pre-149.0.7827.53 versions. Check for browser crashes or unexpected behavior on systems that may have encountered a malicious page before patching. Review network logs for outbound data exfiltration from sensitive internal web applications if you suspect targeted attacks. Monitor for phishing emails or watering-hole indicators that could precede exploitation. Web application firewalls may flag unusual data patterns in responses, though the vulnerability occurs client-side and may be difficult to detect at the network layer.

Why prioritize this

Despite its Medium severity rating, this vulnerability warrants prompt attention because it targets confidentiality through data exfiltration—a top concern for regulated organizations. The attack vector is network-based and requires only user interaction, making it practical for targeted campaigns against your workforce. Chromium's ubiquity means nearly all your users are likely affected. While not critical, treating it as a high-priority patch (30-day remediation target) aligns with security best practices for privacy-relevant flaws.

Risk score, explained

CVSS 3.1 score of 4.3 reflects a Medium-severity issue: the attack is network-based with low complexity and no authentication required (AV:N/AC:L/PR:N), but user interaction is mandatory (UI:R), and impact is limited to confidentiality in an unchanged security context (S:U/C:L/I:N/A:N). The score appropriately captures that this is a privacy leak, not a system compromise or denial-of-service attack. However, business context—regulatory exposure, targeted user population, enterprise data sensitivity—may warrant treating it more aggressively than the numerical score suggests.

Frequently asked questions