Loading vulnerability…
Out-of-sandbox memory disclosure in Google Chrome Skia
CVE-2026-91733 is an improper state validation vulnerability in Skia in Google Chrome versions earlier than 153.0.8010.47. A remote attacker who has already compromised the renderer process can use a crafted HTML page to read memory outside the browser sandbox. Chromium classifies the vulnerability as High severity. The specific affected function and invalid state conditions are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation breaches the sandbox's memory confidentiality boundary, allowing disclosure of potentially sensitive information outside the compromised renderer's permitted memory scope. Arbitrary code execution, memory modification, and denial of service are not established as direct consequences of this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, restrict affected browsers and applications from processing untrusted web content and retain sandboxing, renderer isolation, and least-privilege controls. These measures reduce exposure but do not correct the state validation flaw.
Patch, then assume compromise.
Upgrade Google Chrome to 153.0.8010.47 or later on Windows and Linux, and 153.0.8010.48 or later on macOS, then restart the browser. For affected derivatives, update Microsoft Edge to 153.0.4234.46 or later or Prisma Browser to 153.3.4.48 or a later vendor-confirmed fixed release. On Debian 13, install Chromium 153.0.8010.47-2~deb13u1 or later. For other distribution packages and applications bundling Skia, apply the corresponding vendor security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.