CVE-2026-9909: Integer overflow in Skia in Google Chrome prior to 148

Synopsis

An integer overflow in Skia, the graphics library bundled with Google Chrome, allows a remote attacker who has already compromised the Chrome renderer process to execute arbitrary code within the browser sandbox. The attack requires the victim to visit a crafted HTML page, and it is reachable over the network, though no credentials are needed and exploitation depends on high-complexity preconditions including the prior renderer compromise. Successful exploitation gives the attacker code execution inside the sandbox, which can be chained with a sandbox escape for full host access. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's Chrome instance must be reachable or directed to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account are needed; the attack is initiated entirely through a publicly accessible web page.

• Victim interactionRequired

  The victim must open a crafted HTML page in the affected browser, requiring at minimum a navigation action such as clicking a link or being redirected.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the Chrome renderer process before the integer overflow can be triggered, introducing a significant prerequisite step.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control over the sandboxed process.
• Confidential data processed by the renderer, including page content, stored credentials surfaced in autofill, and session tokens, is readable by the attacker.
• The attacker can modify rendered content and inject malicious payloads into pages, enabling data tampering within the browsing session.
• If chained with a separate sandbox escape primitive, the attacker gains code execution on the underlying host operating system.