Uninitialized Use in Skia in Google Chrome prior to 149

The supplied record describes an *uninitialized use* bug in Chrome's Skia graphics component affecting builds prior to 149.0.7827.53 and says the attacker must have already compromised the renderer process to pull sensitive data from process memory. That matters more than the CWE label: this is not the bug that gets them in; it is the bug they use *after* gaining execution inside a sandboxed renderer. Public June 2026 Chrome CNA data also shows a very similar Skia bug in the same release train, but the public text there maps to cross-origin data leakage rather than renderer-compromise-required memory disclosure, so the record you provided appears to have an ID/description mismatch.

Google's MEDIUM 6.5 baseline is fine *if* you read it as a browser-side confidentiality issue in isolation, but it is too generous for enterprise patch triage when the renderer-compromise prerequisite is real. Requiring prior renderer code execution is heavy friction: it implies the attacker already landed a separate browser bug or chained exploit, and Chrome's sandbox and site isolation are specifically meant to contain that stage. That pushes this down into cleanup-priority territory rather than break-glass patching.

Why this verdict

• Requires prior compromise: the supplied description says the attacker must have already compromised the renderer process, which means this is not an initial-access bug.
• Post-sandbox context: Chrome's renderer sandbox and site isolation are designed to constrain exactly this sort of post-renderer activity, reducing blast radius versus a direct browser-process or OS compromise.
• Confidentiality-only outcome: the stated impact is information disclosure, not direct code execution, persistence, or privilege escalation.
• No exploitation evidence: no KEV listing, no public exploitation statement, and no public PoC lowers urgency for a 10,000-endpoint fleet.
• Scanner blind spot cuts both ways: yes, this is hard to detect directly, but it is also hard to operationalize without a separate exploit chain.

Why not higher?

Because the hardest step is outside this CVE: the attacker must first win renderer execution with some other bug or chain. Once a finding is that dependent on prior compromise, it stops being a first-order patch emergency and becomes a chain-hardening issue. Also, the described impact is bounded to confidentiality loss rather than arbitrary code execution or system takeover.

Why not lower?

It still lives in one of the most exposed applications in the enterprise: the web browser. If the prerequisite is satisfied, memory disclosure inside a compromised renderer can still help steal tokens, recover sensitive fragments, or improve reliability for a follow-on sandbox escape. So this is not ignorable; it is just not front-of-the-line emergency work.

1. Force-enable Chrome auto-update — Make sure fleet policy is not delaying desktop Chrome security rollouts unnecessarily. For a LOW noisgate verdict there is no mitigation SLA, so this is hygiene rather than emergency containment; use it to keep endpoints drifting to 149.0.7827.53/54 inside the normal backlog window.
2. Reduce exposure to malicious browsing — Keep web filtering, remote browser isolation where already deployed, safe browsing, and ad/script reputation controls enabled. These do not fix the bug, but they lower the chance of users reaching the kind of exploit staging content needed to satisfy the renderer-compromise prerequisite; implement and validate during normal operations, not as an emergency.
3. Harden identity reuse paths — Enforce MFA, short session lifetimes, and conditional access for sensitive SaaS. If a browser leak ever exposes tokens or session material, these controls limit downstream abuse; for a LOW verdict, tune and validate within routine security engineering cycles.
4. Monitor browser child-process anomalies — Use EDR and browser telemetry to alert on unusual chrome.exe child behavior, exploit-like crashes, or suspicious network egress after browser instability. This is one of the few practical ways to catch real abuse because direct vulnerability scanning cannot see runtime exploit chains.

Run this on the target endpoint or via your software-distribution/remote-exec tooling. Invoke with python3 check_chrome_149.py on macOS/Linux or py check_chrome_149.py on Windows; no admin rights are required unless your environment restricts access to application metadata, and the script checks common Chrome install paths plus the Windows registry.

#!/usr/bin/env python3
# check_chrome_149.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return ''


def check_windows():
    # Registry first
    reg_paths = [
        r'HKLM\SOFTWARE\Google\Chrome\BLBeacon',
        r'HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\SOFTWARE\Google\Chrome\BLBeacon',
    ]
    for rp in reg_paths:
        out = run_cmd(['reg', 'query', rp, '/v', 'version'])
        v = parse_version(out)
        if v:
            return v, f'registry:{rp}'

    # Common executable paths
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, ''


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, ''


def check_linux():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, ' '.join(cmd)

    paths = [
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium-browser',
        '/usr/bin/chromium',
    ]
    for path in paths:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, ''


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version, source = check_windows()
    elif 'darwin' in system:
        version, source = check_macos()
    else:
        version, source = check_linux()

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    # For this assessment, anything below 149.0.7827.53 is vulnerable.
    # Windows/macOS may show .54 in fixed builds; that still compares as patched.
    if cmp_ver(version, TARGET) < 0:
        print(f'VULNERABLE: detected Chrome {".".join(map(str, version))} from {source}; expected >= {".".join(map(str, TARGET))}')
        sys.exit(1)
    else:
        print(f'PATCHED: detected Chrome {".".join(map(str, version))} from {source}; expected >= {".".join(map(str, TARGET))}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Early Stable Update for Desktop
2. Canadian Centre for Cyber Security AV26-544
3. Vulnerability-Lookup Chrome CNA mirror for June 2026 batch
4. Chromium Multi-process Architecture
5. Chromium Site Isolation
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. Chromium Issue 501861921