CVE-2026-17914

Analyzed Analyzed - Analysis Complete

Side-Channel Information Leakage in Google Chrome

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17914

EUVD

EUVD-2026-50663

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1300	The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.

Attack-Flow Graph

Executive Summary

This vulnerability is a side-channel information leakage in Skia, a graphics library used by Google Chrome. It allows a remote attacker to extract potentially sensitive data from the memory of a vulnerable Chrome process by tricking a user into visiting a specially crafted HTML page.

Detection Guidance

Detection requires checking the Chrome version. Run chrome://version/ in Chrome to verify if the version is prior to 151.0.7922.72. If vulnerable, update Chrome immediately.

Impact Analysis

If exploited, this flaw could let an attacker access sensitive information stored in your browser's memory, such as passwords, cookies, or other private data, without needing direct access to your system.

Compliance Impact

This vulnerability involves side-channel information leakage in Skia within Google Chrome, which could allow a remote attacker to access sensitive process memory via a crafted HTML page. Such information exposure may potentially violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information), depending on the context of data processed in the affected environment.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later. Disable unnecessary browser features if updates are delayed. Avoid visiting untrusted websites until patched.

Hi! I’m here to help you understand CVE-2026-17914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70