PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6364 Google CVE debrief

CVE-2026-6364 is an out-of-bounds read vulnerability in Skia, the 2D graphics library used by Google Chrome. The flaw exists in Chrome versions prior to 147.0.7727.101 and allows a remote attacker to obtain potentially sensitive information from process memory by convincing a user to open a crafted file. The vulnerability was assigned a Medium severity rating by Chromium security with a CVSS 3.1 score of 6.5. The issue was published on April 15, 2026, and the CVE record was last modified on May 26, 2026. The root cause is categorized under CWE-125 (Out-of-bounds Read). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-05-26
Advisory published
2026-04-15
Advisory updated
2026-05-26

Who should care

Organizations and individuals using Google Chrome to handle files from external or untrusted sources, particularly those in environments where sensitive data may be present in browser process memory. Security teams responsible for browser security posture and patch management should prioritize this update.

Technical summary

The vulnerability resides in Skia, Chrome's graphics rendering engine. An out-of-bounds read condition can be triggered when processing a specially crafted file, leading to exposure of process memory contents. The attack requires user interaction to open the malicious file. The confidentiality impact is rated high per CVSS, though integrity and availability are unaffected. The fix was released in Chrome 147.0.7727.101.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Google Chrome to version 147.0.7727.101 or later to remediate this vulnerability
  • Apply security updates through Chrome's automatic update mechanism or manual download from official Google channels
  • For managed enterprise environments, validate Chrome version deployment across endpoints and prioritize patching for systems handling untrusted file content
  • Monitor for anomalous Chrome crashes or unexpected memory-related behavior that could indicate exploitation attempts
  • Review and restrict execution policies for file types that may trigger Skia rendering operations from untrusted sources

Evidence notes

The vulnerability affects Google Chrome versions prior to 147.0.7727.101. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The weakness is classified as CWE-125 (Out-of-bounds Read) by both the primary and secondary sources.

Official resources

The vulnerability was disclosed through official Chromium security channels on April 15, 2026, with a stable channel update released to address the issue. The underlying bug is tracked in the Chromium issue tracker.