EUVD-2026-54141
GHSA-4q2q-m4q6-9jr6
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects mandatory prior renderer compromise; S:U confirms sandbox containment with no scope change to the host system.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free in Skia, Chrome's 2D graphics rendering engine, enables arbitrary code execution within the renderer sandbox in Google Chrome versions prior to 151.0.7922.109. Exploitation requires an attacker to have already achieved renderer process compromise, making this a second-stage chained payload rather than a standalone initial access vector - a prerequisite that materially constrains real-world exploit delivery. No public exploit code has been identified at time of analysis, and SSVC confirms Exploitation: none and Automatable: no, though C/I/A impacts are rated High within the sandboxed scope.
Technical ContextAI
Skia is Google's open-source 2D graphics library embedded in Chrome responsible for rendering web page content including paths, text, and images. CWE-416 (Use After Free) indicates that a Skia object's memory is freed while a dangling pointer to that region is retained; when that pointer is subsequently dereferenced - triggered by processing a crafted HTML page - an attacker who controls the freed memory region can redirect execution flow. The CVSS scope modifier S:U confirms the execution is contained within Chrome's renderer sandbox, meaning the exploited process operates under sandbox restrictions. Affected products per EUVD-2026-54141 span all Chrome desktop builds (Windows, macOS, Linux) running versions below 151.0.7922.109. UAF flaws in browser rendering engines are classic second-stage primitives in full-chain browser exploits.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.109 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome auto-updates by default - confirm the installed version is current via chrome://settings/help and force an update if needed. For enterprise deployments, push the update via Google Admin Console or preferred MDM tooling. As a compensating control where immediate patching is not feasible, enforce Chrome's Site Isolation policy (--site-per-process) via enterprise policy, which reduces the blast radius of any renderer compromise and limits the exploitability of this second-stage flaw. Restricting access to untrusted or unknown web origins via network proxies or enterprise URL filtering reduces the attack surface, though it does not eliminate risk. Note: since exploitation requires prior renderer compromise, keeping the full Chrome browser updated - not just this component - reduces the likelihood of the prerequisite condition being met.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today