Description

Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:17:00.150Z",
  "pubdate": "2026-08-06T22:17:00.150Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Skia graphics library in Google Chrome prior to version 151.0.7922.109. This security flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability carries a high security severity rating according to Chromium security classifications.\nThe primary risk associated with this flaw involves sandbox escape or arbitrary code execution capabilities achieved through memory corruption within the browser architecture. Exploitation requires the attacker to successfully compromise the renderer process initially and lure a user to load a malicious, crafted HTML page designed to trigger the use-after-free condition in Skia. Successful exploitation compromises the integrity and security boundary of the browser environment.",
  "technicalDetails": "The vulnerability is rooted in a use-after-free memory management defect residing within the Skia component of Google Chrome. A use-after-free condition occurs when a program continues to use a pointer after the memory allocation it references has been deallocated or freed. This typically happens due to complex object lifecycle management, dangling pointers, or race conditions during dynamic memory handling within the rendering engine.\nThe attack flow begins when a user navigates to a malicious, crafted HTML page controlled by an adversary. Assuming the attacker has previously achieved execution or compromise within the constrained renderer process, parsing the crafted HTML content triggers improper memory handling inside the Skia graphics library. Specifically, an object is freed while references to it remain active. When the program subsequently attempts to access the dangling pointer, the memory may have been reallocated for other purposes, leading to predictable or controllable memory corruption.\nBy carefully manipulating heap allocations, an attacker can coerce the application into executing arbitrary machine instructions pointed to by corrupted vtables or function pointers. This technique facilitates arbitrary code execution within the context of the affected process. Although the attacker initiates the sequence from within the compromised renderer process, achieving arbitrary code execution inside the sandbox represents a significant escalation, potentially bypassing intended containment mechanisms designed to restrict malicious actions to the isolated renderer sandbox environment.\nThe affected product is Google Chrome, specifically versions prior to 151.0.7922.109, utilizing the vulnerable Skia component. Exploitation relies on network exposure via web content loaded through standard web protocols and HTTP/HTTPS mechanisms. No authentication is required beyond the user interacting with or loading the crafted HTML page. The vulnerability demands a prior compromise of the renderer process as a prerequisite precondition for triggering the flaw and escalating privileges or executing arbitrary code inside the sandbox."
}