CVE-2026-11024: Stack buffer overflow in Skia in Google Chrome prior to 149

Synopsis

A stack-based buffer overflow exists in Skia, the graphics rendering library embedded in Google Chrome versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation gives an attacker full read, write, and crash capability over the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; the attacker needs only to get the victim to load the malicious page.

• Victim interactionRequired

  The victim must actively visit the crafted HTML page, making this a social-engineering vector such as a phishing link or malicious ad redirect.

• Attack complexityDetail

  Exploit reliability is high and imposes no special environmental conditions; the overflow is triggered predictably by the malformed page content.

Blast Radius

• Reads arbitrary memory within the Chrome renderer process, exposing session tokens, saved credentials, and in-page user data.
• Writes to the call stack, enabling an attacker to redirect execution and run attacker-supplied code inside the renderer sandbox.
• Crashes the affected Chrome renderer process, causing the active tab to die and any unsaved user state to be lost.
• If a sandbox escape is chained, attacker code runs at the privilege level of the Chrome process on the host system.