CVE-2015-1213

What it actually does

Out-of-bounds write in SkBitmap::ReadRawPixels during Skia bitmap filter processing allows memory corruption that can lead to denial of service or arbitrary code execution.

Why it matters to the business

Browser instability or successful exploitation can interrupt user workflows, expose sensitive data, and require emergency patching across large fleets of endpoints.

How an attack unfolds

An attacker hosts a specially crafted web page or image resource that reaches the vulnerable Skia code path in Chrome; when the browser parses the content, the out-of-bounds write occurs, enabling memory manipulation for code execution or crash.

How to fix it

Upgrade Google Chrome to version 41.0.2272.76 or newer; apply the latest stable channel updates as soon as they become available.

How to confirm the fix worked

Verify installed Chrome version is at or above 41.0.2272.76; attempt reproduction with known trigger vectors in a controlled test environment and confirm absence of crash or corruption.

Typical attack path

1. Deliver malicious HTML or image content via a web page or embedded resource
2. Trigger Skia bitmap decoding and filtering routines
3. Cause out-of-bounds write to corrupt memory
4. Leverage corruption for code execution or denial of service

How to detect it

Search browser crash logs and process dumps for Skia-related faults; monitor for unexpected terminations when rendering web content containing bitmap data.

What your security team should do

• Prioritize browser updates across all managed endpoints
• Enable automatic updates where possible
• Review web proxy or endpoint logs for unusual Chrome crash patterns