CVE-2026-103629: google chrome Integer Overflow or Wraparound
CVSS: 4.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-103629DEBIAN-CVE-2026-103629CGA-455g-94vm-2g4qCGA-4r3v-qrpf-wmj5CGA-5pj2-7jv3-m7fpCGA-98pf-2fmv-7xp8CGA-p2xc-3h67-q4jfCGA-pq6v-7f4v-jh3m
Published 02-10-2026Last modified 03-10-2026
Vulnerability summary
CVE-2026-103629 is a medium (CVSS 4.3) Integer Overflow or Wraparound vulnerability in google chrome. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.20%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 02-10-2026PublishedVulnerability first disclosed.
- 03-10-2026Last modifiedVulnerability information updated.
Description
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
03-10-202621-10-2026
EPSS score0.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- chromium< 154.0.8037.97-r0
- chromium-docker-selenium-compat< 154.0.8037.97-r0
- chromium-lang< 154.0.8037.97-r0
Wolfi3 products
- chromium< 154.0.8037.97-r0
- chromium-docker-selenium-compat< 154.0.8037.97-r0
- chromium-lang< 154.0.8037.97-r0
Debian2 products
- chromiumAll versions (No fix recorded) | < 155.0.8059.39-1~deb12u1 | < 155.0.8059.39-1~deb13u1
- libskiaAll versions (No fix recorded)
Google1 product
- chrome≥ 154.0.8037.97, < 154.0.8037.97 | < 154.0.8037.97
Ubuntu1 product
- libskiaAll versions (No fix recorded)
5 vendors · 10 products
References
5 links- chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.htmlREPORTRelease NotesVendor Advisory
