Loading vulnerability…
Out-of-bounds read in Google Chrome Skia
CVE-2026-126841 is a high-severity out-of-bounds read vulnerability in the Skia component of Google Chrome before version 157.0.8103.78. A remote attacker who has already compromised a renderer process can use a crafted HTML page to read memory outside the sandbox. The specific vulnerable function is not publicly identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation discloses memory outside the renderer sandbox, compromising confidentiality. The vulnerability does not establish standalone initial compromise, arbitrary code execution, or integrity or availability impact.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify deployment across managed devices. A fixed version for Debian's Chromium package is not identified.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.