A heap buffer overflow in the Skia graphics engine of Google Chrome allows a remote attacker who has already compromised a renderer process to trigger a memory overwrite by serving a specially crafted HTML page. The flaw can lead to a potential escape from the browser sandbox, a critical weakness identified as CWE-122, and is classified as essential for maintaining browser isolation.

All desktop installations of Google Chrome older than version 150.0.7871.46 are affected. The June 2026 stable channel update releases the fix and removes the bounds‑checking flaw in the Skia rendering path, requiring users to upgrade to version 150.0.7871.46 or newer.

The CVSS score of 8.3 indicates high severity, while the EPSS score of < 1% suggests a low but non‑zero likelihood of exploitation in the wild. Because the attacker must first compromise the renderer process, the attack vector is indirect and inferred to involve a malicious HTML page that triggers the overflow after renderer subversion. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known active exploitation at the time of reporting.