CVE-2026-16417: Uninitialized Use in Skia
Chromium: CVE-2026-16417 Uninitialized Use in Skia
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
— MITRE
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 150.0.7871.181 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 150.0.4078.96 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
debian/libskiato a version that resolves this vulnerability.Fixed in 146.20260602~git.3476902+dfsg-5 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.54.0-1~deb13u3Fixed in 2.54.2-2 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.54.2-1 - Upgrade
Upgrade
Microsoft Edge (Chromium-based) / Chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.182 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 150.0.7871.182
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-16417?
CVE-2026-16417 has a high severity rating, indicating a significant risk to users.
How do I fix CVE-2026-16417?
To mitigate CVE-2026-16417, update Google Chrome to version 150.0.7871.182 or later.
What type of vulnerability is CVE-2026-16417?
CVE-2026-16417 is categorized as an uninitialized use vulnerability in Skia within Google Chrome.
What impact does CVE-2026-16417 have on users?
CVE-2026-16417 allows attackers to leak cross-origin data, compromising user data privacy.
Which versions of Google Chrome are affected by CVE-2026-16417?
CVE-2026-16417 affects Google Chrome versions prior to 150.0.7871.182.