CVE-2026-118351 in Chrome
Summary
by MITRE • 10/28/2026
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the Skia graphics library, which serves as the core rendering engine for Google Chrome prior to version 156.0.8078.73, represents a critical failure in memory safety protocols that allows for arbitrary code execution under specific conditions. This flaw is classified as a high-severity issue by Chromium security teams because it bridges the gap between remote content and local system compromise through sophisticated exploitation techniques targeting the browser's sandboxing mechanisms. The root cause lies in improper handling of memory allocation or deallocation processes within Skia, leading to states such as use-after-free, buffer overflow, or heap corruption when processing malformed graphical data embedded in web pages.
From a technical perspective, this vulnerability falls under the category of CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific memory state manipulation involved. When an attacker crafts an HTML page containing specially constructed graphics commands or image data, they can trigger these memory corruption errors during the rendering phase. The Skia library processes this input to render visual elements on the screen, but due to insufficient bounds checking or logic errors in pointer management, it writes data beyond allocated buffer boundaries or accesses freed memory regions. This allows an attacker to overwrite adjacent memory structures, including function pointers or object vtables, which are critical for control flow hijacking during execution.
The operational impact of this vulnerability is severe because it enables a remote code execution attack vector that bypasses Chrome's multi-process architecture and sandbox restrictions. Typically, browser sandboxes isolate web content from the operating system to prevent malicious scripts from accessing sensitive files or executing arbitrary binaries. However, by exploiting memory corruption in Skia, an attacker can achieve arbitrary read/write primitives within the renderer process. Through further exploitation techniques such as heap spraying orROP chain construction, this internal control is escalated to escape the sandbox and execute code with the privileges of the user running the browser. This effectively neutralizes one of the primary defense layers against web-based attacks, allowing for full system compromise without any physical access or social engineering beyond delivering a malicious link.
This attack scenario aligns closely with MITRE ATT&CK techniques related to Initial Access via Spearphishing Link and Execution through Command and Scripting Interpreter within browser contexts. The exploitation path typically involves hosting the crafted HTML page on a server, waiting for a victim to visit it, or embedding it in an email attachment that opens directly in Chrome. Once executed, the malicious code can download additional payloads, establish persistence mechanisms, exfiltrate sensitive data such as cookies and session tokens, or pivot into internal network resources if the user has access to them. The high severity rating reflects both the ease of exploitation for skilled attackers and the broad impact on confidentiality, integrity, and availability across millions of users relying on Chrome for secure browsing.
Mitigation strategies primarily focus on immediate patching by upgrading Google Chrome to version 156.0.8078.73 or later, where these memory management flaws in Skia have been corrected through rigorous code review and fuzz testing updates. Organizations should enforce automated update policies to ensure all endpoints are running the latest stable release of Chromium-based browsers. Additionally, implementing strict Content Security Policy headers can help mitigate some downstream effects by restricting script execution sources, although this does not prevent the initial memory corruption exploit itself. For enterprise environments, deploying endpoint detection and response solutions that monitor for anomalous process creation or sandbox escape attempts provides an additional layer of defense against successful exploitation of such zero-day or recently patched vulnerabilities.