External risk intelligence

Skia Buffer Overflow in Chrome Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121086

This vulnerability exists within the client-side rendering engine of a web browser. While it requires a user to visit a crafted web page, the vulnerability itself is located in a client-side application. It does not represent a public-facing service, gateway, or internet-exposed infrastructure, making it inherently unlikely to be a component of an internet-facing attack surface in the context of this metric.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Skia graphics component used within Google Chrome. This flaw could potentially allow an attacker to execute malicious code by luring a user to a compromised webpage. While the direct impact on internal systems is mitigated by Chrome's sandbox, the potential for code execution warrants attention.

A graphics component flaw could allow malicious code.
It affects user interaction with web pages.
Confirm relevance and exposure to user activity.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page, which would then interact with the Skia component within Google Chrome. This interaction could lead to the attacker executing arbitrary code on the user's system, bypassing security restrictions.

Requires user to visit a malicious page.
Triggered by crafted HTML content.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox when a user visits a crafted HTML page. This could affect the security and integrity of the user's system.

User's system integrity.
Visiting a malicious HTML page.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Skia, affecting Google Chrome, requires a coordinated response across several teams. The platform or browser management team is likely responsible for deploying updates, while security operations should focus on identifying exposure and potential impact. Vendor management may be involved if commercial versions of Chrome are in use, and application owners should be aware of the risk to end-users. The immediate priority is to confirm the presence of affected Chrome versions within the environment, assess their reachability and criticality, and identify the accountable owners before planning remediation, likely during a scheduled maintenance window.

Platform and security teams own the issue.
Verify Chrome version and user exposure.
Plan remediation and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Skia and why is it part of Google Chrome?

Skia is an open-source 2D graphics library that serves as the core rendering engine for Google Chrome. It is responsible for drawing the text, shapes, and images you see on web pages. Because it processes complex visual data from the internet, it is a critical component for browser performance and display consistency.

What does CVE-2026-121086 mean by buffer overflow?

A buffer overflow (CWE-122) occurs when a program tries to store more data in a temporary memory storage area, or buffer, than it is designed to hold. In this specific CVE, an attacker uses crafted HTML to overflow the Skia library's memory. This excess data can overwrite adjacent memory, potentially allowing the attacker to run unauthorized commands on the computer.

How is this vulnerability triggered by an attacker?

The vulnerability is triggered when a user visits a malicious website containing specially crafted HTML content designed to exploit the Skia engine. Simply having Chrome installed does not trigger the bug; the attacker requires the user to actively navigate to the harmful page. It is not triggered by automated network traffic or background processes that do not involve rendering this specific type of malicious web content.

Is my system at risk if I use Chrome on my local computer?

While this is a critical flaw, Halo Surface Signal notes it exists within the client-side rendering engine rather than a public-facing network service or gateway. The risk is tied to the websites users visit. Because it targets the end-user's browser, the primary concern is for endpoints where users access the internet, rather than internal servers or infrastructure that do not perform general web browsing.

How do I address this Chrome security issue?

The primary response is to update your Google Chrome installation to version 157.0.8103.38 or later. Check your browser's 'About' page to trigger an automatic update if it has not already occurred. Ensure that all users in your environment are notified to restart their browsers to finalize the patch, as the fix resides within the updated software version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.