Description

Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:06.540Z",
  "pubdate": "2026-08-25T21:18:06.540Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in Skia, the 2D graphics library utilized within Google Chrome. Affecting Chrome web browser versions prior to 152.0.7977.65, this flaw presents a security risk classified as Low severity by the Chromium security team. The vulnerability specifically allows a remote threat actor who has already successfully compromised the renderer process to read sensitive memory locations within the browser's sandbox environment.\nTo exploit this vulnerability, an attacker must serve a malicious, specifically crafted HTML page designed to trigger the out-of-bounds memory access condition in Skia. Although constrained by the boundaries of the renderer sandbox, the unauthorized exposure of memory contents presents a significant risk, as it can leak critical data such as memory layout structures, pointers, and heap configurations. This information exposure can subsequently be leveraged to facilitate more complex, multi-stage attacks, including sandbox escapes, when chained with other vulnerabilities. Organizations utilizing Google Chrome are advised to update to the remediated version immediately to prevent unauthorized information disclosure and maintain sandbox integrity.",
  "technicalDetails": "The root cause of this security issue lies within the Skia graphics engine, a core open-source component responsible for rendering text, geometries, images, and vector graphics in Google Chrome. An out-of-bounds read (classified under CWE-125) occurs when the rendering pipeline attempts to access memory outside the allocated buffer boundaries during graphics processing operations. This typically happens when parsing complex or malformed visual assets, canvas elements, or SVG parameters delivered via a web page. Because Skia operates heavily on raw memory pointers to achieve high-performance rendering, a validation failure in array indexing or size calculations can lead to the engine reading adjacent memory segments that it should not have access to.\nIn a typical exploitation flow, the attacker must establish an initial foothold. Because this vulnerability requires a compromised renderer process, the attacker must first leverage a separate vulnerability (such as a remote code execution exploit) to gain control over Chrome's renderer process. Once inside the sandboxed renderer, the attacker executes code that interacts with the vulnerable Skia APIs using a crafted HTML page. This crafted page forces Skia to execute rendering operations with invalid dimensions, offset parameters, or manipulated texture maps, exceeding the limits of the designated memory buffer.\nAs a result of this out-of-bounds read, the compromised renderer process can retrieve data from neighboring heap allocations or system structures residing within the same sandboxed memory space. Although the browser's sandbox prevents the renderer from directly accessing the underlying operating system or filesystems, this read capability leaks critical metadata. Information such as heap layouts, function pointers, and base addresses of loaded modules can be exfiltrated. This leakage effectively nullifies Address Space Layout Randomization (ASLR) protections within the renderer process, equipping attackers with the precise memory maps required to craft highly reliable subsequent exploits, potentially leading to a full sandbox escape when paired with kernel or browser-level privilege escalation vulnerabilities.\nFurthermore, the lack of robust bounds checking in the affected versions of Skia allowed these invalid offset requests to pass through unchecked. In memory-safe operations, any request to access an index beyond the allocated buffer size should trigger an immediate exception or safe default fallback. However, in the vulnerable versions prior to 152.0.7977.65, Skia failed to enforce these strict boundary conditions. This architectural oversight permitted the execution of unsafe pointer arithmetic, directly leading to the exposure of raw memory bytes to the compromised renderer process, which can then be serialized and analyzed by the attacker."
}