An integer overflow in the Skia graphics library bundled with Google Chrome versions before 150.0.7871.47 can allow a remote attacker who has already compromised the renderer process to escape the renderer sandbox. The flaw is a CWE‑472 integer overflow that could enable the attacker to execute code with elevated privileges on the host system, potentially accessing sensitive data or launching additional attacks.

Google Chrome browsers on all desktop platforms that ship with the Skia library and run the renderer under sandbox restrictions, for any build earlier than 150.0.7871.47. Versions released after that build include the patch and are no longer affected.

The CVSS score of 8.3 indicates high severity, while the EPSS of <1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first get control of the renderer process—an objective that can be achieved via a malicious web page that renders content in Chrome. Once the renderer is compromised, a crafted HTML page can trigger the integer overflow and enable a sandbox escape.