CVE-2026-10925: Out of bounds write in Skia in Google Chrome on Mac prior to 149

Synopsis

An out-of-bounds write vulnerability in Skia, the graphics rendering library bundled with Google Chrome on macOS, affects all Chrome versions before 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with access to the underlying host system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credentials on the target system are needed to initiate the attack.

• Victim interactionRequired

  The victim must visit a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious redirect.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must first have compromised the Chrome renderer process before this out-of-bounds write can be used for sandbox escape, introducing a meaningful prerequisite beyond simply serving a page.

Blast Radius

• Reads sensitive data accessible to the Chrome process, including stored credentials, session tokens, and local profile data, after escaping the sandbox.
• Modifies files and system state on the host outside the browser sandbox boundary.
• Disrupts or crashes host-level processes by writing to arbitrary memory locations outside permitted ranges.
• Gains a foothold on the macOS host that can be used for further lateral movement or persistence within the container or system environment.