CVE-2026-9981: Chrome Skia Information Disclosure Vulnerability – Patch Guidance

Technical summary

CVE-2026-9981 is an information disclosure vulnerability in Skia, the graphics engine used by Chrome, stemming from inappropriate implementation of a graphics operation. The flaw permits a remote, unauthenticated attacker to read sensitive data from process memory by crafting a malicious HTML page. The vulnerability affects Chrome versions prior to 148.0.7778.216 and is classified as CWE-200 (Information Exposure). The Chromium project assigned it High security severity. The network-adjacent attack vector combined with low attack complexity and requirement for user interaction (clicking a malicious link) results in a CVSS v3.1 score of 6.5 (Medium), reflecting the high confidentiality impact but lack of integrity or availability compromise.

Business impact

Information disclosure vulnerabilities in widely-deployed browsers pose significant organizational risk. Successful exploitation could expose credentials, session tokens, personal data, or other sensitive information cached in Chrome's memory during a user's browsing session. For enterprises, this translates to potential credential harvesting, lateral movement vectors, or compliance violations if sensitive customer or regulated data is accessed. The barrier to exploitation—simply tricking a user to visit a compromised or attacker-controlled site—makes this a practical threat that security teams must treat seriously despite the 'Medium' CVSS rating.

Affected systems

Google Chrome (all versions prior to 148.0.7778.216) on Windows, macOS, and Linux is the primary target. While the CVE lists Microsoft Windows, Apple macOS, and Linux kernel as affected vendor/product combinations, the vulnerability is specific to Chrome's Skia implementation; the operating systems are listed because Chrome runs on them. Organizations should assume any Chrome installation predating version 148.0.7778.216 is vulnerable, regardless of OS.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing a user to visit it—a low-barrier attack that could be delivered via phishing, malicious ads, watering-hole attacks, or compromised legitimate websites. No authentication, user privileges, or local access is needed. The attacker gains read access to process memory, potentially harvesting unencrypted data held by the browser at the time of the visit. This is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the straightforward attack chain and memory disclosure nature make it attractive to both targeted and opportunistic attackers.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Chrome auto-updates by default, but users should verify their version in Settings > About Chrome to confirm they are on a patched build. For enterprise deployments using managed Chrome versions, verify your enterprise update channel has rolled out the patched release. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 148.0.7778.216 or later across your environment. Chrome's auto-update mechanism should deliver this patch automatically; however, verify completion in your fleet by checking browser versions on a sample of endpoints. If you manage Chrome through policies (ChromeOS, Windows Active Directory, or Mac MDM), confirm your update infrastructure has deployed the patch. Users should restart Chrome after updating to ensure the new version is active; closing and reopening the browser is typically sufficient. No special configuration changes are required post-patch.

Detection guidance

Direct detection of exploitation attempts is difficult because the attack manifests as normal web traffic and memory reads internal to the process. Monitor for unusual web browsing patterns to suspicious or newly registered domains, especially if targeted at specific user groups. DNS or web proxy logs may reveal access to known attacker infrastructure hosting exploit pages. Endpoint detection and response (EDR) tools may flag abnormal memory access patterns within Chrome, though false positives are possible. The most practical detection strategy is vulnerability scanning to identify outdated Chrome versions and incident response preparation for credential compromise scenarios that may result from successful exploitation.

Why prioritize this

Despite a 'Medium' CVSS score, this vulnerability warrants high-priority patching because (1) Chrome is ubiquitous and constantly exposed to web content, (2) the attack chain is straightforward and requires only social engineering, (3) memory disclosure can directly compromise credentials and sensitive data, and (4) no active KEV listing does not mean no exploitation—opportunistic attackers may be developing exploits. Organizations should patch within their standard critical or high-priority windows, treating this as urgent rather than routine maintenance.

Risk score, explained

The CVSS v3.1 score of 6.5 (Medium) reflects high confidentiality impact (potential memory exfiltration) balanced against no integrity or availability impact and the requirement for user interaction to visit a malicious page. While CVSS does not capture the frequency of browser updates or the ubiquity of Chrome, security teams should weigh the 'Medium' rating against the practical likelihood of exploitation and the sensitivity of data in browser memory (credentials, tokens, PII) when setting internal prioritization.

Frequently asked questions