CVE-2026-84359: Infoleak
Published Sep 1, 2026
·Updated
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Affected Software
2 affected components
Google Google Chrome<152.0.7977.75
Google Skia<152.0.7977.75
Event History
Sep 1, 2026
CVE Published
via MITRE·11:42 PM
Data Sourced
via MITRE·11:42 PM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker must first compromise the Chrome renderer process. They can then use a crafted HTML page to leak cross-origin data.
2
Which Chrome versions should be remediated?
Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or later.
3
Is this a standalone remote compromise vulnerability?
No. The described attack requires a prior renderer-process compromise, so it is most relevant as a follow-on vulnerability that can expose cross-origin data after that initial compromise.