CVE-2026-103629 in Chrome
Summary
by MITRE • 10/02/2026
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified as an integer overflow within the Skia graphics library, which serves as the core 2D rendering engine for Google Chrome prior to version 154.0.8037.97, represents a critical failure in memory boundary validation during image processing operations. This flaw arises when arithmetic calculations involving dimensions or offsets of graphical elements exceed the maximum value representable by the allocated integer type, causing the result to wrap around and produce an unexpectedly small positive number rather than triggering an error condition. In the context of Skia, such miscalculations often occur during rasterization tasks where pixel buffers are allocated based on computed width and height values. When these calculations overflow, the system allocates a memory buffer significantly smaller than what is required to hold the actual image data intended for rendering.
This discrepancy between the allocated buffer size and the amount of data written by Skia leads to an out-of-bounds write condition that extends beyond the boundaries of the heap-allocated buffer into adjacent memory regions. While traditional integer overflows in this context might lead to crashes or arbitrary code execution, the specific manifestation described here facilitates a cross-origin information leak. An attacker can craft a malicious HTML page containing carefully constructed SVG or canvas elements that trigger this overflow during rendering. By manipulating the layout and timing of these graphical operations, the attacker can control which adjacent memory contents are overwritten with predictable data patterns from the image buffer.
The operational impact centers on the ability to read sensitive cross-origin data through side-channel effects resulting from memory corruption. When the out-of-bounds write corrupts neighboring heap metadata or other allocated objects, it alters their state in a way that can be detected by subsequent JavaScript operations within the same page context. For instance, if adjacent memory contains pointers or size fields belonging to another object used for cross-origin requests, modifying these values can cause errors or behavioral changes when those objects are accessed later. By observing how the browser handles these corrupted states during resource loading or DOM manipulation, an attacker can infer the contents of that adjacent memory, effectively bypassing same-origin policies and extracting sensitive information such as authentication tokens, personal data, or internal application state from other origins hosted on the same domain or subdomain.
This vulnerability aligns with CWE-190, which defines integer overflow or wraparound errors, specifically in scenarios where signed integers are used for arithmetic operations without proper range checking. From a tactical perspective, this exploit technique maps to MITRE ATT&CK techniques related to Memory Manipulation and potentially Data Exfiltration over Alternative Protocols if the leaked data is transmitted externally. The attack vector requires user interaction via visiting a crafted webpage, classifying it as an initial access or execution phase depending on whether further exploitation chains are employed after the information leak occurs.
Mitigation for this vulnerability primarily involves upgrading to Google Chrome version 154.0.8037.97 or later, where the Skia library has been patched with rigorous bounds checking and safe arithmetic functions that prevent wraparound behavior during dimension calculations. Developers integrating Skia into custom applications should ensure they are using updated versions of the graphics library and implement strict validation for all input parameters related to image dimensions before passing them to rendering APIs. Additionally, enabling browser security features such as Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) can help mitigate some risks associated with cross-origin data leakage by isolating browsing contexts more strictly. Regular patching of the underlying graphics libraries is essential given their central role in web rendering pipelines across multiple platforms.