CVE-2026-10941: Out of bounds memory access in Skia in Google Chrome prior to 149

Synopsis

An out-of-bounds memory access vulnerability exists in Skia, the graphics rendering library embedded in Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable and able to load remote content.

• AuthenticationNot required

  No account, session token, or credential of any kind is required to deliver the exploit.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout luck, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the rendering process for the affected tab.
• Confidential data visible to the renderer, including page content, session state, and in-memory credentials, is exposed to the attacker.
• The attacker can tamper with page content and in-memory state within the sandboxed process, potentially staging further exploitation toward a sandbox escape.
• The compromised renderer process can be crashed or made unavailable, disrupting the user session for the affected tab.