Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics engine could allow a remote attacker to bypass security protections (the sandbox) if they have already compromised the browser's rendering process. This could lead to unauthorized access to the underlying operating system and user data.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Skia graphics library component of Google Chrome. The vulnerability can be triggered by a remote attacker via a specially crafted HTML page. Exploitation requires the attacker to have already compromised the renderer process (a high-complexity precondition). If successful, the attacker can achieve a sandbox escape, potentially leading to full system compromise. Google has addressed this issue in Chrome version 147.0.7727.138 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-04-01: disclosed: Reported by Google internal researchers
- 2026-04-28: patched: Fixed in version 147.0.7727.138
- 2026-04-28: advisory