EUVD-2026-54138
GHSA-fg55-p4v2-8v56
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise prerequisite; S:C captures sandbox escape to OS; UI:R required for victim to load the crafted page.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering library embedded in Chrome's renderer process, responsible for drawing text, shapes, and images. CWE-787 (Out-of-Bounds Write) occurs when code writes data past the boundaries of an allocated memory buffer, corrupting adjacent heap or stack memory and potentially enabling control-flow hijacking. In Chrome's multi-process architecture, the renderer operates in a sandboxed process with heavily restricted OS privileges. An OOB write in Skia can corrupt renderer memory structures to craft exploit payloads that cross the sandbox boundary into the more-privileged browser process or OS layer. The CVSS scope change metric (S:C) directly reflects this sandbox-escaping characteristic. EUVD-2026-54138 tracks this issue in European vulnerability infrastructure.
RemediationAI
The primary fix is updating Google Chrome to version 151.0.7922.109 or later, which contains the vendor-released patch addressing the Skia out-of-bounds write, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome typically auto-updates, but enterprise administrators should verify fleet-wide patch status through Chrome Browser Cloud Management or equivalent tools. As a compensating control for environments unable to patch immediately, restricting navigation to untrusted or unknown websites via proxy or DNS filtering reduces exposure, though this significantly limits browser utility. Chrome's existing site isolation features mitigate some renderer exploit impact but do not prevent sandbox escape once a renderer is compromised. Disabling hardware-accelerated graphics would reduce Skia's attack surface but is not confirmed to mitigate this specific issue and carries significant performance trade-offs.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today