Description

Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:57.660Z",
  "pubdate": "2026-08-06T22:16:57.660Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Skia graphics library within Google Chrome on Android prior to version 151.0.7922.109. This vulnerability enables a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape by processing a maliciously crafted HTML page.\nThe flaw carries severe risk implications, as escaping the restricted renderer sandbox significantly increases the potential for arbitrary code execution, privilege escalation, and full system or device compromise. Exploitation requires the victim to render a specifically crafted HTML page that triggers memory corruption within the Skia rendering engine.\nThe affected product is Google Chrome on Android running versions prior to 151.0.7922.109, specifically involving the Skia component. Defensive posture relies on prompt browser updates to incorporate vendor-supplied patches that resolve the memory management defect within the affected graphics library.",
  "technicalDetails": "The vulnerability is a use-after-free (UAF) condition residing in the Skia graphics library utilized by Google Chrome on Android. A use-after-free flaw occurs when memory is dynamically allocated, subsequently freed, but pointers referencing the deallocated memory location persist and are later dereferenced.\nThe vulnerable component is the Skia rendering engine handling complex graphical operations and layout rendering driven by web content. The affected software versions comprise Google Chrome on Android prior to 151.0.7922.109.\nPrerequisites for successful exploitation dictate that an attacker must first compromise the renderer process, typically achieved by executing arbitrary JavaScript or leveraging a separate vulnerability within the browser's JavaScript engine or parsing logic. Network exposure is present in the sense that the attack vector requires the victim to load or interact with a crafted HTML page containing malicious graphical instructions or payloads designed to manipulate heap layouts.\nThe step-by-step attack flow begins when the victim navigates to or renders the crafted HTML page hosted by the attacker. As the browser parses the document and constructs visual elements, the Skia graphics component processes specific sequences of operations that induce a premature deallocation of a memory object while retaining a dangling pointer.\nSubsequently, the attacker triggers the re-use of the dangling pointer through controlled heap manipulation or via asynchronous event handling. When the application dereferences the freed memory block, the execution flow can be hijacked or memory contents corrupted.\nBecause the initial exploitation occurs within the context of a compromised renderer process, the ultimate payload behavior aims to leverage this memory corruption primitives to break out of the restricted security sandbox boundaries, thereby executing code or escalating privileges outside the confined renderer environment on the Android operating system."
}