Description

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T20:17:25.610Z",
  "pubdate": "2026-09-03T20:17:25.610Z",
  "executiveSummary": "A critical memory corruption vulnerability identified as a use-after-free exists within the Skia graphics library integrated into Google Chrome.\nThis security flaw allows a remote, unauthenticated attacker to execute arbitrary code within the context of the browser's sandbox environment.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.82.\nThe risk is classified as high due to the potential for complete system compromise if the attacker successfully escapes the sandbox or leverages additional vulnerabilities.\nExploitation requires the victim to render a specifically crafted HTML page, which triggers the memory safety violation in the Skia engine.\nSuccessful exploitation bypasses standard security protections, potentially leading to unauthorized data access, arbitrary code execution, or further system infiltration.",
  "technicalDetails": "The vulnerability originates from improper memory management within the Skia graphics library, specifically a use-after-free (UAF) condition.\nA UAF occurs when an application continues to use a pointer to a memory location after that memory has been deallocated or freed, typically leading to undefined behavior or exploitation.\nIn this context, the Skia component fails to properly manage the lifecycle of objects during complex rendering operations initiated by maliciously crafted HTML content.\nThe attack flow begins when a remote attacker delivers a crafted HTML page to a victim's browser. When the rendering engine attempts to process this page, it invokes the vulnerable Skia functions.\nThe attacker leverages the UAF to manipulate the heap, effectively gaining control over an object that is incorrectly accessed after it has been freed. By grooming the heap, the attacker can replace the freed object with controlled data, enabling a primitive for code execution.\nBecause the rendering occurs within the browser process, the initial code execution happens inside the Chromium sandbox.\nThe impact includes the ability for an attacker to bypass memory safety protections. If the attacker chains this vulnerability with a sandbox escape, they could achieve full control over the host operating system.\nThe vulnerability resides within the Skia library components responsible for hardware-accelerated drawing and path manipulation. Given that Skia is deeply integrated into the rendering pipeline, even minor defects in object lifetime management can be triggered through standard web interactions like CSS transformations, SVG rendering, or canvas manipulation.\nThe exploitation does not require prior authentication or elevated privileges, making it highly dangerous for users navigating to untrusted websites.\nPost-exploitation behavior typically involves the injection of malicious payloads into the memory space of the renderer process, where the attacker can then exfiltrate sensitive data, intercept user inputs, or attempt to pivot into more sensitive system areas."
}