CVE-2026-9893
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A Use-After-Free vulnerability in the Skia library in Google Chrome prior to 148.0.7778.216 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is rated as Critical severity by Chromium.
Risk Assessment
An attacker can break out of the browser sandbox and gain access to the underlying operating system, leading to full device and organizational data compromise.
Recommendation
Immediately update Google Chrome to version 148.0.7778.216 or later. Scan systems for signs of exploitation.
Other vulnerabilities in Skia
See all- CVE-2016-5168High
Skia, as used in Google Chrome before version 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information.
- CVE-2013-6648High
A vulnerability in Skia allows remote attackers to cause a denial of service by exploiting the SkRegion::setPath function.
- CVE-2016-7395High
In Skia, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, the return values of ChopMonoAtY calls are not properly validated. This may allow remote attackers to cause a denial of service through uninitialized memory access and application crash.
- CVE-2016-1691High
Skia, as used in Google Chrome before version 51.0.2704.63, mishandles coincidence runs, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted curves.
- CVE-2015-6617High
Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2015-3877High
Skia, as used in Android before version 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2015-1280High
In Skia, used in Google Chrome before version 44.0.2403.89, there is a vulnerability that allows remote attackers to cause a denial of service (memory corruption) by leveraging access to a renderer process and providing crafted serialized data.
- CVE-2015-1360High
Skia in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing.
- CVE-2014-7904High
Buffer overflow in Skia, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
- CVE-2014-1557High
The ConvolveHorizontally function in Skia, used in Mozilla Firefox before version 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution. This allows remote attackers to execute arbitrary code by triggering prolonged image scaling.
Original NVD description (English source)
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)