CVE-2026-7923: Google Chrome RCE Vulnerability

CVE-2026-7923 Overview

CVE-2026-7923 is an out-of-bounds write vulnerability in the Skia graphics library used by Google Chrome versions prior to 148.0.7778.96. The flaw [CWE-787] allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox using a crafted HTML page. Google classified the Chromium security severity as High. The vulnerability affects Chrome on Windows, macOS, and Linux.

Critical Impact

A successful exploit chain combining a renderer compromise with CVE-2026-7923 enables sandbox escape, granting attackers code execution outside Chrome's restricted process boundary on the host operating system.

Affected Products

• Google Chrome prior to 148.0.7778.96 on Microsoft Windows
• Google Chrome prior to 148.0.7778.96 on Apple macOS
• Google Chrome prior to 148.0.7778.96 on Linux

Discovery Timeline

• 2026-05-06 - CVE CVE-2026-7923 published to NVD
• 2026-05-06 - Last updated in NVD database
• Stable Channel Update - Google releases the fix in Chrome 148.0.7778.96 via the Google Chrome Stable Update

Technical Details for CVE-2026-7923

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render canvas, SVG, and other graphical content. An out-of-bounds write [CWE-787] occurs when Skia processes specific rendering operations triggered by attacker-controlled HTML and graphics primitives. Writing past an allocated buffer corrupts adjacent memory in the renderer's address space.

Because Skia code executes inside the GPU or renderer process, an attacker who has already achieved code execution in the renderer can use this primitive to corrupt structures shared across the sandbox boundary. The result is a path toward sandbox escape, which moves attacker code from a low-privilege renderer into a higher-privilege Chrome process or onto the host. The high attack complexity reflects the prerequisite renderer compromise and the need to chain this bug with another flaw.

Root Cause

The root cause is improper bounds checking inside a Skia memory write operation. Specific drawing or buffer-handling logic fails to validate the size or offset of a write against the destination allocation. Crafted HTML invokes the affected Skia code path with parameters that drive the write past the allocated region.

Attack Vector

Exploitation requires the attacker to first compromise the Chrome renderer process, typically via a separate renderer-resident bug. The attacker then loads a crafted HTML page that invokes the vulnerable Skia path. User interaction is required, consistent with normal browser navigation. Successful exploitation can escape the sandbox and impact confidentiality, integrity, and availability across the changed scope.

No public proof-of-concept or exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are tracked in Chromium Issue #500080194, which remains restricted at the time of publication.

Detection Methods for CVE-2026-7923

Indicators of Compromise

• Unexpected child processes spawned by chrome.exe, Google Chrome Helper, or related browser binaries, especially shells or scripting interpreters.
• Renderer or GPU process crashes referencing Skia modules in crash dumps or chrome_debug.log.
• Outbound connections from Chrome processes to untrusted domains immediately after visiting a page with heavy canvas, SVG, or WebGL content.

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any host running a build older than 148.0.7778.96.
• Hunt for browser process trees where a Chrome renderer or GPU process is the parent of a non-browser executable.
• Correlate Skia-related crash telemetry with subsequent suspicious process or network activity on the same host.

Monitoring Recommendations

• Forward endpoint process, file, and network telemetry to a central analytics platform and retain at least 30 days for retrospective hunting.
• Alert on Chrome child processes invoking cmd.exe, powershell.exe, bash, osascript, or unsigned binaries from user-writable paths.
• Monitor for browser-initiated writes to autorun locations, scheduled tasks, or LaunchAgents that may indicate post-sandbox-escape persistence.

How to Mitigate CVE-2026-7923

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.96 or later on all Windows, macOS, and Linux endpoints.
• Restart Chrome after the update so that all renderer and GPU processes load the patched Skia code.
• Audit managed Chrome deployments and enterprise policies to confirm automatic updates are enabled and not blocked by group policy or MDM.

Patch Information

Google fixed CVE-2026-7923 in the Chrome Stable channel release 148.0.7778.96. Refer to the Google Chrome Stable Update advisory for the full list of fixes shipped in this version. Chromium-based browsers that incorporate the same Skia code, including Microsoft Edge, Brave, Opera, and Vivaldi, should be updated to versions that pull in the upstream fix.

Workarounds

• No vendor workaround replaces patching; prioritize the update.
• Restrict browsing to trusted sites on unpatched hosts and block high-risk categories at the web proxy until updates complete.
• Enforce least-privilege user accounts so that any sandbox escape lands in a non-administrative context.
• Consider deploying site isolation and strict process-per-site policies via enterprise Chrome configuration to raise exploitation cost.

# Verify Chrome version on Linux/macOS
google-chrome --version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update on Windows via the Google Update service
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler