Loading vulnerability…
Sandboxed Remote Code Execution via Integer Overflow in Google Chrome Skia
CVE-2026-126876 is a high-severity integer overflow vulnerability in the Skia graphics component of Google Chrome before version 157.0.8103.78. A remote attacker can trigger the flaw through a crafted HTML page and execute arbitrary code within Chrome's sandbox. The specific vulnerable function and arithmetic operation have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within Chrome's sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability does not establish a sandbox escape or full-device compromise.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify deployment across managed devices rather than assume automatic updates have completed. Debian Chromium is also identified as affected, but a fixed Debian package version is not specified.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.