CVE-2026-118319 in Chrome
Summary
by MITRE • 10/28/2026
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified involves a critical memory corruption flaw within the Skia graphics library, which serves as the core 2D rendering engine for Google Chrome and other Chromium-based browsers prior to version 156.0.8078.73. This component is responsible for handling complex graphical operations such as text layout, image processing, and vector graphic rendering on web pages. The specific nature of this flaw allows a remote attacker who crafts a malicious HTML page containing specially constructed graphics or canvas elements to trigger an out-of-bounds memory access. When the browser processes these crafted inputs during the rendering pipeline, it fails to properly validate buffer boundaries or handle pointer arithmetic correctly, leading to a state where internal memory structures are accessed beyond their allocated limits. This type of error is classified under CWE-125 as Out-of-Bounds Read, indicating that the application reads data from a memory location outside the intended boundary of an array or buffer.
The operational impact of this vulnerability is significant due to its potential for remote code execution and information disclosure within the browser's security sandbox. Although Chrome employs a multi-process architecture with strict sandboxing to limit the damage caused by exploits, a successful exploitation of this Skia flaw could allow an attacker to read sensitive data from inside the sandboxed renderer process. This includes potentially accessing cookies, session tokens, or other authentication credentials stored in memory that are not directly exposed through standard web APIs. The ability to perform arbitrary reads within the sandbox can serve as a stepping stone for more sophisticated attacks, such as bypassing sandbox protections via side-channel techniques or leveraging additional vulnerabilities to achieve full code execution with user privileges. Consequently, this issue is assigned a High severity rating by the Chromium security team because it directly undermines the isolation mechanisms designed to protect users from malicious web content.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter if leveraged for further exploitation, but more accurately maps to T1213 Data from Information Repositories when used for data exfiltration within the sandbox environment. The attack vector is classified as Network (Remote) because it requires no user interaction beyond visiting a maliciously crafted website or being redirected via phishing links. The presence of this flaw highlights the risks associated with complex rendering engines that process untrusted input, emphasizing the need for rigorous memory safety checks in low-level graphics libraries. Developers must ensure that all buffer operations are bounded and that error conditions resulting from invalid inputs do not lead to undefined behavior such as out-of-bounds reads or writes.
To mitigate this risk, organizations and individual users should immediately update Google Chrome to version 156.0.8078.73 or later, where the underlying Skia library has been patched to include proper bounds checking for memory access operations during rendering tasks. For enterprise environments utilizing managed deployment tools, it is advisable to enforce automatic updates to ensure all endpoints are protected against this specific exploit chain. Additionally, security teams should monitor browser telemetry and endpoint detection systems for unusual network activity or process behavior that might indicate an attempted exploitation of graphics-related vulnerabilities. Implementing strict content security policies can also help reduce the attack surface by limiting the types of scripts and resources that can interact with canvas elements and rendering contexts, thereby reducing the likelihood of triggering such memory corruption flaws in unpatched versions.