Executive brief
Google Skia, a graphics engine used in web browsers and mobile operating systems, contains a critical security flaw that allows attackers to corrupt system memory. By tricking a user into visiting a specially crafted website, an attacker could potentially execute malicious code or crash the application. This vulnerability is particularly serious as it has been observed being used in active attacks in the wild.
Technical details
An out-of-bounds (OOB) write vulnerability (CWE-787) exists in the Skia graphics library as integrated into Google Chrome and other products. The flaw is triggered when the engine processes a specially crafted HTML page, leading to unauthorized memory access. This is a remote attack vector that requires minimal user interaction (visiting a URL) and no prior authentication. Successful exploitation can lead to arbitrary code execution within the context of the browser renderer process or a denial-of-service condition. Google has released patches in Chrome version 146.0.7680.75 and later to address this issue.
Affected products
- Google Skia prior to 146.0.7680.75
- Google Chrome prior to 146.0.7680.75
- Google ChromeOS
- Google Android
- Google Flutter
Timeline
- 2026-03-13: disclosed
- 2026-03-13: advisory
- 2026-03-13: kev added: Added to CISA KEV catalog due to active exploitation.
- 2026-03-13: patched: Fixed in Chrome 146.0.7680.75