Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-19176 Use after free in Skia
Chromium: CVE-2026-76041 Information leak in Skia
Chromium: CVE-2026-14419 Use after free in Skia
Chromium: CVE-2026-79020 Out of bounds read in Skia
Chromium: CVE-2026-84359 Information leak in Skia
Chromium: CVE-2026-17914 Side-channel information leakage in Skia
Chromium: CVE-2026-13885 Use after free in Skia
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Chromium: CVE-2026-3909 Out of bounds write in Skia
Chromium: CVE-2023-6350 Out of bounds memory access in libavif
Chromium: CVE-2023-6351 Use after free in libavif
Chromium: CVE-2023-6346 Use after free in WebAudio
Chromium: CVE-2023-6347 Use after free in Mojo
Chromium: CVE-2023-6348 Type Confusion in Spellcheck
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/#CVE-2018-18493
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-03/#CVE-2018-5095
A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5467
Acknowledgements:
Name: the Mozilla project Upstream: Heather Miller (Google Skia team)
SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash).