CVE-2026-11124: Integer overflow in Skia in Google Chrome prior to 149

Synopsis

An integer overflow in Skia, the graphics rendering library embedded in Google Chrome, affects all Chrome versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but a user must visit a crafted HTML page for exploitation to succeed. Successful exploitation gives an attacker heap corruption primitives that enable reading sensitive data, modifying memory, or crashing the browser process, potentially leading to remote code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential on the target system is needed; the attack is launched from an unauthenticated position.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must use phishing or another social-engineering vector to trigger the exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker gains heap corruption primitives in the Chrome renderer process, enabling reads of in-memory data such as stored credentials, session tokens, or page content.
• Memory writes through the corrupted heap allow an attacker to modify browser state or inject code, potentially escalating to full renderer compromise.
• The affected process can be crashed on demand, killing the active browser tab or worker and disrupting the user session.
• Depending on sandbox escape primitives available at exploit time, compromise of the renderer can be chained toward code execution on the underlying host.