- CVE-2026-5870: prevent integer overflow in the pixel offset calculations of SkReadPixelsRec/SkWritePixelsRec by routing them through SkSafeMath - CVE-2026-7920: stop getRPProgram() mutating the shared SkSL program, which raced with the Ganesh backend reading it and freed IR nodes under it - CVE-2026-7923: fix the discard_stack guard in the SkSL raster pipeline builder so it no longer removes more stack entries than the op pushed - CVE-2026-10009: bound the number of partial contours in SkPathWriter::assemble so the folded-triangle entry count can no longer overflow - CVE-2026-11663: replace the single shared glyph-run builder on SkCanvas with a stack of builders, drop drawable serialization from SkCustomTypeface and restrict the tags deserialized from SkPictures - All five are backports into the vendored Skia only; no public API or ABI of the package is touched.