Improper input validation in the Skia graphics library within Google Chrome allowed an attacker to craft a malicious HTML page that could lead to execution of arbitrary code in an elevated context, effectively breaking out of the browser sandbox. The flaw was classified as a high severity vulnerability by Chromium and is based on CWE-20, which relates to inadequate validation or handling of input data.

This issue affects all users of Google Chrome versions prior to 156.0.8078.79 across all platforms where the Skia library is used. The vulnerability is limited to the Chrome product; no other vendors or products are affected.

The vulnerability can be exploited remotely by hosting or serving a malicious HTML document that a victim browser renders. Because it relies on a client‑side flaw, the attack vector is likely to be a drive‑by scenario or a phishing link. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog, indicating no recorded exploitation yet. The high severity rating suggests that a successful exploitation could compromise system confidentiality, integrity, and availability.