CVE-2026-14387

The vulnerability consists of an integer overflow error in the Skia component — a 2D graphics engine used by Chrome to render content. An attacker can provide a specially crafted HTML page whose processing triggers incorrect arithmetic calculations leading to overflow. This results in unpredictable memory behavior that can be exploited to break out of the browser's isolated execution environment (sandbox). CWE-472 indicates improper handling of externally controlled numerical values.

An attacker may potentially execute a Chrome sandbox escape, which can lead to execution of malicious code outside the browser environment, and consequently to taking control over the victim's system.

Google Chrome should be updated to version 150.0.7871.46 or newer. The update is available through Chrome's built-in update mechanism or on the manufacturer's website according to the references.

Google Chrome versions earlier than 150.0.7871.46