CVE-2026-10011
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An inappropriate implementation in the Skia library in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue is rated as high severity.
Risk Assessment
An attacker could exfiltrate sensitive data from other origins, such as session tokens or personal information, leading to privacy breaches and potential account compromise.
Recommendation
Immediately update Google Chrome to version 148.0.7778.216 or later. Ensure all Chromium-based systems (e.g., Electron) also receive the patch.
Original NVD description (English source)
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)