CVE-2026-126876: Integer overflow in Skia
Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.78
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-126885
- CVE-2026-126895
- CVE-2026-126879
- CVE-2026-126846
- CVE-2026-126911
- CVE-2026-126864
- CVE-2026-126889
- CVE-2026-126859
- CVE-2026-126886
- CVE-2026-126887
- CVE-2026-126870
- CVE-2026-126912
- CVE-2026-126919
- CVE-2026-126878
- CVE-2026-126909
- CVE-2026-126847
- CVE-2026-126853
- CVE-2026-126865
- CVE-2026-126916
- CVE-2026-126903
- CVE-2026-126910
- CVE-2026-126842
- CVE-2026-126898
- CVE-2026-126871
- CVE-2026-126875
- CVE-2026-126862
- CVE-2026-126900
- CVE-2026-126904
- CVE-2026-126907
- CVE-2026-126851
- CVE-2026-126845
- CVE-2026-126881
- CVE-2026-126867
- CVE-2026-126863
- CVE-2026-126896
- CVE-2026-126869
- CVE-2026-126858
- CVE-2026-126891
- CVE-2026-126874
- CVE-2026-126918
- CVE-2026-126866
- CVE-2026-126844
- CVE-2026-126884
- CVE-2026-126894
- CVE-2026-126861
- CVE-2026-126917
- CVE-2026-126856
- CVE-2026-126905
- CVE-2026-126873
- CVE-2026-126922
- CVE-2026-126914
- CVE-2026-126880
- CVE-2026-126872
- CVE-2026-126877
- CVE-2026-126888
- CVE-2026-126843
- CVE-2026-126854
- CVE-2026-126892
- CVE-2026-126897
- CVE-2026-126857
- CVE-2026-126883
- CVE-2026-126840
- CVE-2026-126848
- CVE-2026-126882
- CVE-2026-126906
- CVE-2026-126915
- CVE-2026-126893
- CVE-2026-126855
- CVE-2026-126908
- CVE-2026-126849
- CVE-2026-126901
- CVE-2026-126852
- CVE-2026-126850
- CVE-2026-126841
- CVE-2026-126902
- CVE-2026-126868
- CVE-2026-126921
- CVE-2026-126913
- CVE-2026-126890
- CVE-2026-126860
- CVE-2026-126920
- CVE-2026-126899
Frequently Asked Questions
Which Chrome versions are affected?
Google Chrome versions prior to 157.0.8103.78 are affected. Updating to 157.0.8103.78 or later addresses the affected version range described.
What does an attacker need to exploit this issue?
An attacker needs to cause the target to process a crafted HTML page. The issue can be exploited remotely and does not state that prior local access is required.
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution inside the Chrome sandbox. The provided information does not establish execution outside the sandbox.