Memory corruption in the Skia graphics library, used by Google Chrome, permits a remote attacker to run arbitrary code outside the browser sandbox when a victim opens a specially crafted HTML page. The flaw is a classic buffer overflow (CWE‑119) and was rated high severity by Chromium security investigations. An attacker could use this to compromise the system on which the browser is running, gaining full control over the user’s machine. The impact extends beyond the browser, potentially enabling further lateral movement within the network.

This issue affects Google Chrome on all desktop platforms running a version older than 156.0.8078.73. The vulnerability is present in the Skia rendering component tied to the Chrome stable channel. Any machine that has the affected Chrome build installed and is exposed to malicious web content is at risk, regardless of operating system.

The vulnerability is exploitable from a remote web page and therefore only the victim’s browser needs to be compromised. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known widespread exploitation yet. The high severity suggests a potentially serious impact, but lack of current exploitation data means that the threat remains theoretical until active exploitation is observed. Attackers will need to lure a user to a malicious site that serves a crafted HTML payload that triggers the Skia overflow.