CVE-2025-0436

CVE-2025-0436 is an integer overflow vulnerability in the Skia graphics library used by Google Chrome prior to version 132.0.6834.83. The flaw enables potential heap corruption when rendering a crafted HTML page, as classified under CWE-472. Chromium rates its security severity as High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A remote attacker can exploit this vulnerability by luring a user to visit a malicious website containing the crafted HTML page, requiring user interaction such as clicking a link but no special privileges. Successful exploitation could allow the attacker to achieve high-impact corruption of the heap, potentially leading to arbitrary code execution and full compromise of the browser's confidentiality, integrity, and availability.

Google's stable channel update for desktop, announced via the Chrome Releases blog, patches this issue in version 132.0.6834.83 and later. Additional technical details are documented in the associated Chromium issue tracker. Security practitioners should prioritize updating affected Chrome installations to mitigate the risk.