EUVD-2026-35263
GHSA-hc8r-4qxg-x57v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconVictim visits attacker page
-
DeliveryExploit prior renderer bug
-
ExploitCompromise sandboxed renderer
-
InstallDeliver crafted Skia HTML
-
C2Trigger use-after-free in Skia
-
ExecuteEscape Chromium sandbox
-
ImpactExecute code at user privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires three concrete prerequisites stacked: (1) the attacker must already have arbitrary code execution inside a Chrome renderer process via a separate renderer-RCE bug - this CVE alone cannot compromise a fresh tab; (2) the victim must load and interact with attacker-controlled HTML that drives Skia into the vulnerable code path (UI:R); (3) the running Chrome build must be earlier than 149.0.7827.103. Limiting factors: high attack complexity (AC:H) per the CVSS vector implies the UAF likely needs specific heap state or timing, the chain dependency means defenders who block the first-stage renderer bug also block this one, and auto-update on Chrome Stable shrinks the vulnerable window for most consumer endpoints to days. |
| Impact | The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a chained attack: network-reachable but high complexity, no privileges yet user interaction required, with a scope change capturing the sandbox escape. This is not a one-click RCE - the description explicitly requires a pre-existing renderer compromise, so this bug is a second-stage component in an exploit chain rather than a standalone entry point. No EPSS, KEV, or SSVC data is provided, and no public exploit identified at time of analysis, which lowers immediate mass-exploitation risk. Realistically this is a high-priority browser patch (sandbox escapes are weaponized by commercial spyware and nation-state actors against targeted users) but is unlikely to drive opportunistic attacks before a chain is published. |
| Exploit ScenarioDerived | An attacker lures a target to a malicious or compromised website that first exploits a separate Chrome renderer vulnerability (e.g., a V8 or Blink bug) to gain code execution inside the sandboxed renderer. The attacker's payload then loads a crafted HTML/canvas page that triggers the Skia use-after-free, corrupting freed heap state to pivot out of the renderer sandbox into the browser/GPU process and obtain code execution at the user's privilege level. No public exploit identified at time of analysis, but Skia sandbox-escape primitives are historically attractive to commercial exploit developers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox escape in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a use-after-free in the Skia graphics library. The flaw is rated High severity by Chromium and carries a CVSS 8.3, but exploitation requires both a prior renderer compromise and user interaction with a crafted HTML page. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 - update Chrome Stable to that version or later via the built-in updater or by redeploying managed packages, then restart the browser to load the patched Skia. Enterprise administrators should verify rollout via chrome://settings/help on a sample of endpoints and accelerate the auto-update channel where it has been pinned. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be upgraded once their vendors ship a build incorporating the Skia fix; track each vendor's release notes referenced from https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the Chromium issue at https://issues.chromium.org/issues/513820666. Until patched, the only meaningful compensating control is to restrict browsing to trusted sites via enterprise policy or site isolation enforcement and, on high-risk endpoints, disable hardware acceleration (Settings → System) to reduce some Skia GPU paths - note this degrades rendering performance and does not eliminate the CPU Skia code path, so it is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Skia, the 2D graphics rendering library used by Chrome (and many Chromium-derived browsers) to draw paths, text, and images. CWE-416 (Use After Free) means an object in Skia is freed while a dangling reference is still in scope; subsequent access to that memory allows an attacker to manipulate freed-then-reallocated heap chunks to corrupt control data. Because Skia code runs in a privileged GPU/browser process boundary (not solely the sandboxed renderer), a UAF here is a classic sandbox-escape primitive - it lets a compromised renderer reach across the IPC boundary and gain code execution in a less-restricted process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a sandbox escape vulnerability that allows attackers with an already-compromised renderer process to achieve system-level code execution through a use-after-free flaw in the Skia graphics library. Organizations must prioritize immediate patching to prevent privilege escalation attacks that could grant full system access to threat actors who have compromised employee browsers. This vulnerability significantly increases risk for staff accessing potentially malicious content or operating on compromised networks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB