EUVD-2026-54265
GHSA-rhrm-pw3p-v8j2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Chained exploit requiring prior renderer compromise drives AC:H; sandbox escape to Android OS context drives S:C and full C/I/A:H; no prior privileges needed to serve the initial page.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome on Android (prior to 151.0.7922.109) via a use-after-free vulnerability in the Skia graphics library allows a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox through a crafted HTML page. The CVSS vector (S:C, C:H/I:H/A:H) confirms full cross-boundary compromise, elevating an attacker from renderer-level code execution to broader Android OS access. No active exploitation is confirmed at time of analysis (SSVC exploitation: none; not listed in CISA KEV), though Technical Impact is rated total by CISA's SSVC framework.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering engine embedded in Chrome and used for painting web content. CWE-416 (Use After Free) describes a class of memory safety flaw where heap memory is freed but a dangling pointer to that region is subsequently dereferenced, enabling an attacker to control object behavior by placing attacker-controlled data at the freed address. In Chrome's multi-process architecture, the renderer process handles untrusted web content within a sandbox; a Skia UAF reachable from script or HTML parsing can be leveraged by an attacker who already has renderer-level code execution to violate sandbox integrity. The scope change (S:C in the CVSS vector) reflects that successful exploitation crosses from the sandboxed renderer into the broader Android OS privilege domain. The bug was tracked internally at issues.chromium.org/issues/532941869 and reported via chrome-cve-admin@google.com.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.109 or later via the Google Play Store or Chrome's internal update mechanism. This is a vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. No workaround is known for the Skia UAF itself; however, defenders should note that exploitation requires a prior renderer compromise, so any runtime controls that reduce renderer attack surface (e.g., disabling JavaScript or restricting untrusted site browsing via enterprise policy) would reduce the overall likelihood of the full chain succeeding - though these carry significant usability trade-offs. Organizations managing Android fleet devices should prioritize patching via MDM policy enforcement.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today