CVE-2026-10009: Integer overflow in Skia in Google Chrome prior to 148

Synopsis

An integer overflow in Skia, the graphics library embedded in Google Chrome, allows a remote attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox. The vulnerability is reachable over the network and requires no authentication, but the attacker must trick a user into visiting a crafted HTML page and must already control the renderer process, making this a chained or multi-stage exploit. Successful exploitation achieves full code execution inside the sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the affected Chrome instance must be reachable or able to fetch remote content from an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; the attack is initiated entirely through a webpage any unauthenticated user can visit.

• Victim interactionRequired

  The target user must open or be directed to a crafted HTML page, requiring a social-engineering or phishing step to trigger the exploit.

• Attack complexityDetail

  Attack complexity is high; the attacker must first have compromised the renderer process through a separate vulnerability before this integer overflow can be leveraged for code execution.

Blast Radius

• Executes arbitrary code inside the Chrome sandbox, giving the attacker control over the renderer process's full execution context.
• Reads sensitive in-memory data accessible to the renderer, including page content, credentials autofilled on the current page, and session tokens.
• Modifies in-memory state and rendered output, enabling tampering with page content or in-browser data before it reaches the user.
• Crashes or destabilizes the affected renderer process, disrupting the user's browsing session and any associated real-time functionality.