Description

Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:59.813Z",
  "pubdate": "2026-08-06T22:16:59.813Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists within the Skia graphics library in Google Chrome prior to version 151.0.7922.109. This vulnerability allows a remote attacker who has already successfully compromised the renderer process to potentially achieve a sandbox escape by leveraging a specially crafted HTML page. Classified with a Chromium security severity of High, this flaw poses significant risk to client-side system integrity by potentially allowing malicious code to break out of low-privileged isolation boundaries. Exploitation requires the attacker to first execute code within the compromised renderer process, typically via malicious web content processed by the browser engine. Successful exploitation undermines the multi-process architecture of the browser, potentially exposing the underlying host system to further compromise.",
  "technicalDetails": "The vulnerability stems from an out-of-bounds write memory corruption flaw located in the Skia component of Google Chrome. Skia serves as the 2D graphics library responsible for rendering shapes, text, and bitmaps within the browser engine. The root cause involves improper bounds checking or arithmetic overflow conditions during memory allocation or buffer manipulation operations when parsing specially crafted graphical instructions embedded within an HTML document. The vulnerable component is the Skia graphics rendering engine utilized by Google Chrome prior to version 151.0.7922.109. The attack flow initiates when a user navigates to a malicious web page hosting a crafted HTML payload designed to trigger the out-of-bounds write condition. Prior to executing the attack, the adversary must have already compromised the browser's renderer process through a separate initial vulnerability, such as a remote code execution flaw within the JavaScript engine or document parsing pipeline. Operating from within the confines of the compromised renderer process, the attacker invokes malicious rendering sequences that force Skia to write data outside the allocated memory buffer boundaries. This out-of-bounds write condition corrupts adjacent memory structures, heap metadata, or critical control data pointers within the renderer's address space. By carefully manipulating the memory layout and exploiting the heap corruption primitive, the attacker can hijack control flow or corrupt inter-process communication (IPC) channels. This enables the attacker to transition from the restricted renderer sandbox into higher-privileged browser processes or the underlying operating system environment, thereby achieving a sandbox escape. No authentication or elevated local user privileges are required beyond the initial renderer process compromise achieved via remote web interaction."
}