CVE-2026-9983: Type Confusion in Skia in Google Chrome prior to 148

Synopsis

A type confusion vulnerability in the Skia graphics library within Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, enabling data theft, content tampering, or further escalation attempts against the host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach the attacker-controlled or compromised HTML page.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated user who visits the crafted page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker full control of the renderer process.
• Reads in-browser data such as session cookies, saved credentials, and page content visible to the renderer.
• Modifies rendered content or injects script into pages, enabling session hijacking or credential phishing.
• Serves as a foothold for sandbox-escape attempts that could extend attacker control to the underlying host process.