CVE-2018-18356

What it actually does

Integer overflow during path handling in Skia triggers a use-after-free condition that enables heap corruption in the browser rendering process.

Why it matters to the business

Attackers can achieve remote code execution on user systems via malicious web content, leading to potential data theft, malware deployment, and operational disruption across browser-dependent environments.

How an attack unfolds

An attacker crafts a malicious HTML page containing specially formed path data that triggers the integer overflow in Skia. When a victim loads the page, the use-after-free is triggered, allowing heap manipulation and arbitrary code execution within the renderer process.

How to fix it

Upgrade Google Chrome to version 71.0.3578.80 or later on all affected platforms. For Linux distributions, apply the corresponding patched packages from the respective vendors once available.

How to confirm the fix worked

Verify Chrome reports version 71.0.3578.80 or higher; test rendering of known trigger paths to confirm absence of the integer overflow behavior.

Typical attack path

1. Attacker prepares a crafted HTML page exploiting Skia path handling
2. Victim visits the page via a vulnerable Chrome instance
3. Integer overflow occurs during path processing
4. Use-after-free condition is reached enabling heap corruption
5. Attacker gains code execution in the renderer sandbox

How to detect it

Review browser process crash logs and heap-related exceptions for patterns matching Skia path handling failures; correlate with access to suspicious external HTML resources.

What your security team should do

• Prioritize immediate browser updates across all endpoints due to the age of the vulnerability and potential for exploitation
• Enforce enterprise update policies that prevent users from running versions prior to the fixed release
• Monitor for any renewed exploit activity despite low historical EPSS