Google Chrome EUVD-2026-33187

Requires three concrete prerequisites: (1) the victim runs Google Chrome on Android at a version below 148.0.7778.216, (2) the attacker has already achieved code execution inside Chrome's renderer process via a separate first-stage vulnerability (this CVE is not a standalone entry point despite CVSS PR:N), and (3) the victim must interact with attacker-controlled content - visiting or rendering a crafted HTML page that triggers the vulnerable Skia code path. Limiting factors: High CVSS attack complexity (AC:H) indicates the Skia trigger is not trivially reliable, the bug is Android-specific per the description, and the dependency on a chained renderer RCE means exploitation realistically requires either an attacker with a 0-day renderer bug or N-day chaining against unpatched devices.

The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields 8.3 and reflects the realistic profile: network-reachable via a malicious page, but with High attack complexity, required user interaction, and the implicit prerequisite that the attacker has already compromised the renderer - a condition the CVSS PR:N metric does not capture but the description explicitly states. EPSS is 0.03% (11th percentile) and the bug is not on the CISA KEV list, consistent with no public exploit identified at time of analysis; Chromium's internal 'Critical' rating reflects its value within an exploit chain rather than standalone weaponization. The signals are coherent rather than conflicting: this is a meaningful sandbox-escape primitive that matters greatly to chained Android exploits and targeted attackers, but is not an urgent broad-scale priority outside of patching cadence - note the CVSS PR:N rating is technically misleading because the description requires prior renderer code execution, so defenders should weigh the description over the score alone.

An attacker lures a target on a vulnerable Android Chrome build to a crafted HTML page (phishing link, malvertising, or compromised site); a first-stage renderer-compromise vulnerability gains code execution inside the sandboxed renderer, then this Skia flaw is invoked via specially crafted graphics content to escape the renderer sandbox and reach broader Android privileges. No public exploit is identified at time of analysis, but the Chromium 'Critical' rating signals the bug is suitable as the escape stage of a full Android browser exploit chain typical of commercial spyware and targeted intrusions.