EUVD-2026-41170
GHSA-9v66-88c9-pqcg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker must first control the renderer process (PR:L) and the victim must load content (UI:R); crafted Skia escape is non-trivial (AC:H); sandbox breakout changes scope (S:C) with total impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome (Skia graphics library) prior to 150.0.7871.46 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page, elevating a contained renderer compromise into a full-privilege breakout on the host. Rated High severity by Chromium, it carries a CVSS 3.1 score of 8.3 (scope-changed) with no public exploit identified at time of analysis and CISA SSVC recording exploitation status as none. It is a second-stage vulnerability that must be chained with a prior renderer exploit, so it is not directly exploitable against a fresh browser.
Technical ContextAI
The flaw resides in Skia, the open-source 2D graphics rendering engine that Chrome (and Chromium-derived browsers) uses to rasterize web content, canvas, and GPU-accelerated drawing. The root cause is classified as CWE-20 (Improper Input Validation): Skia insufficiently validates untrusted input, allowing a malicious renderer to feed crafted data that corrupts state across the sandbox boundary. Because graphics operations are frequently marshaled between the sandboxed renderer and higher-privilege GPU/browser processes, a validation gap in Skia is a classic pivot point for sandbox escapes, turning renderer-level control into broader process compromise.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on the Stable Desktop channel, per the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; most installations auto-update, but administrators should force-relaunch to apply the fix and verify via chrome://settings/help. There is no standalone configuration workaround for the Skia flaw itself, but because exploitation requires a prior renderer compromise, keeping the entire browser current (which also closes the renderer-exploit prerequisite) is the effective control. In managed environments, enforce update rollout via Chrome Browser Cloud Management or group policy and confirm all Chromium-derived browsers ingest the upstream Skia fix; where update lag is unavoidable, reducing exposure to untrusted web content and enforcing site isolation limits the blast radius, at the cost of user convenience.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today