EUVD-2026-33204
GHSA-9j42-wp44-pmh2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandboxed arbitrary code execution in Google Chrome (Skia graphics library) prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to execute additional code inside the Chrome sandbox via a crafted HTML page. The flaw is an integer overflow rated High by Chromium's security team with a CVSS of 7.5, but EPSS is very low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis. Exploitation requires user interaction (visiting a page) and a pre-existing renderer compromise, so this is a chain component rather than a standalone RCE.
Technical ContextAI
Skia is the open-source 2D graphics library used by Chromium (and downstream browsers like Edge, Brave, Opera, and Electron apps) to render shapes, images, text, and canvas/WebGL surfaces. CWE-472 (External Control of Assumed-Immutable Web Parameter) is unusual for a memory bug - Chrome advisories sometimes map memory-safety issues to imprecise CWEs, and the description ('integer overflow in Skia') is more consistent with a CWE-190 integer overflow leading to out-of-bounds memory access during graphics buffer sizing or allocation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all builds prior to 148.0.7778.216 on the Stable channel; any Chromium-derived browser shipping the same Skia revision is likely affected as well.
RemediationAI
Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome via the built-in updater (chrome://settings/help) or push the Stable channel update through enterprise management (Chrome Browser Cloud Management, Group Policy, or Jamf/Intune for managed endpoints) as published in https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Downstream Chromium browsers should be updated as soon as each vendor ships a build incorporating the fixed Skia revision (issue tracker: https://issues.chromium.org/issues/499152771). No official workaround is published; if patching must be delayed, compensating controls include enforcing Site Isolation (already default on desktop), keeping the Chrome sandbox enabled (do not deploy with --no-sandbox), and disabling hardware-accelerated canvas/WebGL via enterprise policy (HardwareAccelerationModeEnabled=false) - note this degrades graphics performance and breaks WebGL-dependent sites, so it should be a short-term measure only.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today