CVE-2026-9998: Integer overflow in Skia in Google Chrome prior to 148

Synopsis

An integer overflow in the Skia graphics library within Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The exploit requires the victim to visit or interact with a malicious page, and the attacker must also have prior control of the renderer, making this a chained attack rather than a single-step exploit. Successful exploitation grants the attacker code execution outside the Chrome sandbox, elevating a renderer compromise into a full host-level breach. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, requiring the victim's browser to reach a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credential is needed; the attacker requires only that the victim browse to the malicious page.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, making this exploit dependent on a social-engineering or malicious-ad delivery step.

• Attack complexityDetail

  Attack complexity is rated High, meaning this is a chained exploit that presupposes the attacker has already compromised the Chrome renderer process before the sandbox escape can be attempted.

Blast Radius

• Escapes the Chrome sandbox, giving the attacker arbitrary code execution in the context of the browser process on the host operating system.
• Reads files and secrets accessible to the user running Chrome, including stored credentials, session tokens, and local application data.
• Writes or modifies files on the host, allowing persistence mechanisms such as dropped binaries or modified startup scripts.
• Crashes or destabilizes the affected Chrome process and any dependent services running under the same user account.