CVE-2026-14387: Integer overflow in Skia in Google Chrome prior to 150

Synopsis

An integer overflow in Skia, the graphics rendering library embedded in Google Chrome versions prior to 150.0.7871.46, allows a remote attacker to escape the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does require the victim to visit a malicious page. Successful exploitation gives the attacker full read, write, and denial-of-service capability outside the Chrome sandbox on the host system. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credentials on any system are needed; the attacker only needs to get the victim to load a page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads arbitrary data from outside the Chrome sandbox, including files, session tokens, and credentials accessible to the browser process user.
• Writes or modifies data on the host filesystem or memory regions outside the sandbox, enabling persistence or payload staging.
• Crashes or disrupts host-level processes or services, going beyond a browser tab and affecting the underlying operating system.
• The Changed scope (S:C in the CVSS vector) means impact extends beyond Chrome itself to other components and users sharing the host.