PT-2026-23049 · Skia+2 · Skia+2

Symeon Paraschoudis · Published 2026-02-17 · Updated 2026-05-15 · CVE-2026-3538

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 145.0.7632.159

Description An integer overflow in the Skia graphics engine within Google Chrome versions prior to 145.0.7632.159 could allow a remote attacker to potentially perform out-of-bounds memory access through a specially crafted HTML page. The vulnerability resides in the Skia component.

Recommendations Update Google Chrome to version 145.0.7632.159 or later.

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-472

CWE-191

Related Identifiers

BDU:2026-03182

CVE-2026-3538

OPENSUSE-SU-2026:10296-1

OPENSUSE-SU-2026:20332-1

Affected Products

Google Chrome

Red Os

Skia

References · 40

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3538 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/729817 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3538 · Security Note
• https://bdu.fstec.ru/vul/2026-03182 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-3538 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0423SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20332-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/729805 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10296-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3538 · Security Note
• https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3538 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory