CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in the Skia graphics library used by Google Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the Chrome renderer process can exploit insufficient input validation by serving a crafted HTML page to a victim, breaking out of the browser sandbox entirely. Successful exploitation gives the attacker full code execution outside the browser sandbox, enabling read and write access to the host system and potential denial of service. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credentials on the targeted system are needed; the attack is launched against any user who visits the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors, though it does presuppose a prior renderer compromise.

Blast Radius

• Attacker breaks out of the Chrome browser sandbox, gaining code execution in the context of the host OS user running Chrome.
• Confidential data accessible to that OS user, including session tokens, credentials stored on disk, and local files, becomes readable.
• The attacker can write or modify files on the host filesystem, including configuration files and application data.
• The host process or dependent services can be crashed or made unavailable, disrupting the user's workload.