CVE-2026-91733

Received Received - Intake

Improper State Validation in Skia in Google Chrome

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: Chrome

Description

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-91733

EUVD

EUVD-2026-79968

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	153.0.8010.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper state validation in Skia, a graphics library used by Google Chrome. It allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by tricking a user into visiting a specially crafted HTML page.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access sensitive data stored in memory, potentially leading to information disclosure or further exploitation of the system. Users could be at risk if they visit malicious websites while using an unpatched version of Chrome.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.47 or later to address the improper state validation in Skia.

Hi! I’m here to help you understand CVE-2026-91733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70