EUVD-2026-50779
GHSA-vg76-cfgp-x25q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate exploit
-
DeliveryServe crafted HTML to renderer
-
ExploitTrigger Skia use-after-free
-
ExecutionReclaim freed heap memory
-
PersistCorrupt object to escape sandbox
-
ImpactGain higher-privilege browser process access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is a second-stage sandbox-escape primitive, not a standalone entry point. From that foothold, the attacker must deliver a crafted HTML page that triggers the Skia use-after-free, and the CVSS vector requires user interaction (UI:R), meaning the victim must load the malicious content. Limiting factors: the prerequisite renderer compromise (typically needing a separate chained exploit), high attack complexity (AC:H) reflecting non-deterministic heap grooming needed to reliably reclaim freed memory, and the affected version boundary (Chrome < 151.0.7922.72). It affects default configurations of the desktop browser - no special feature flag is required beyond normal HTML/graphics rendering. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields 8.3 (High), driven largely by the scope change (S:C) and full CIA impact, but tempered by high attack complexity (AC:H) and required user interaction (UI:R). Critically, the vector's PR:N understates the real precondition: the description explicitly requires that the attacker has ALREADY compromised the renderer process, so this is a second-stage sandbox-escape primitive rather than a standalone remote-code-execution entry point. EPSS is low at 0.31% (23rd percentile), there is no CISA KEV listing, and no public exploit is identified - all signals point to this being a real-but-not-imminent priority: important to patch given Chrome's ubiquity and Google's Critical rating, but not evidence of active mass exploitation. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker first compromises Chrome's renderer process using a separate vulnerability (for example, a V8 or DOM bug) delivered via a malicious web page. From within that already-compromised renderer, the attacker serves crafted HTML that triggers the use-after-free in Skia, reclaims the freed memory, and uses the resulting corruption to escape the sandbox into a higher-privilege browser process. High attack complexity and required user interaction (the victim must visit the page) make this a targeted, chained attack rather than a trivial drive-by; no public proof-of-concept has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72. Update Chrome to 151.0.7922.72 or later via Help > About Google Chrome (which triggers the update and requires a browser restart to apply) or through managed enterprise deployment channels; see the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracking bug at https://issues.chromium.org/issues/520514458. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply the equivalent vendor update once their maintainers pick up the patched Skia. As an interim compensating control before patching, restrict browsing to trusted sites and avoid untrusted HTML content, since exploitation requires rendering a crafted page; because this is a sandbox-escape stage that depends on a prior renderer compromise, keeping the renderer itself patched and enabling site isolation reduces the chance an attacker reaches this primitive, though neither fully substitutes for the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Skia, the open-source 2D graphics rendering engine that Chrome (and Chromium-derived browsers) uses to rasterize web content, canvas, and compositing operations. A use-after-free occurs when memory is freed but a dangling pointer to it is subsequently dereferenced, allowing an attacker who controls heap allocations to reclaim the freed region and manipulate program flow. Because Skia code executes across process boundaries in Chrome's multi-process architecture, a UAF here can be leveraged from a compromised renderer to corrupt memory in a more privileged context, enabling a sandbox escape. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop browser.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a pre-compromised renderer (PR:L) and reliable heap grooming plus user interaction (AC:H, UI:R); sandbox escape crosses a trust boundary (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a sandbox escape vulnerability in the Skia graphics library (CVSS 8.3) that permits attackers with renderer-process access to escalate to host-level privileges. No public exploit identified at time of analysis, though the vulnerability represents a significant privilege-escalation path that Google rated as Critical. All users of affected versions face risk, requiring immediate patching.
Apply vendor patch: Google Chrome 151.0.7922.72 or later. No interim mitigations are available; patching is the only effective control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB