CVE-2026-78958 Google CVE debrief

Who should care

Google Chrome users, administrators, and security teams should be aware of this vulnerability and take necessary actions to patch and protect their systems.

Technical summary

The CVE-2026-78958 vulnerability is related to an uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65. This vulnerability allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. The CVSS score is 3.1, and the severity is classified as LOW. The vulnerability affects Google Chrome instances and requires immediate attention to prevent potential cross-origin data exposure. Chromium security severity is Medium.

Defensive priority

Medium severity vulnerability in Google Chrome, requiring immediate attention to prevent potential cross-origin data exposure.

Recommended defensive actions

• Apply the latest Google Chrome update (152.0.7977.65 or later) to patch the vulnerability.
• Ensure that all Google Chrome instances are updated to the latest version.
• Monitor Google Chrome for any suspicious activity related to this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-78958 vulnerability is related to an uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65. The vulnerability allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity is Medium.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.