Loading vulnerability…
Out-of-bounds Read in Google Chrome Skia on macOS
CVE-2026-126871 is a high-severity out-of-bounds read vulnerability in the Skia graphics component of Google Chrome on macOS before version 157.0.8103.78. A remote attacker can trigger the flaw through a crafted HTML page, allowing memory outside the sandbox to be read. The specific vulnerable function and underlying bounds-checking failure have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose memory outside Chrome's sandbox, potentially exposing sensitive information. The vulnerability has a high confidentiality impact; integrity and availability impacts are not identified. Code execution or full system compromise is not established.
Patch, then assume compromise.
Upgrade Google Chrome on macOS to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify that the fixed version is deployed and running across managed devices.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.