Executive brief
Google Chrome is a widely used web browser. A vulnerability in its Skia graphics engine could allow a remote attacker to bypass security boundaries (sandbox escape) if they have already compromised the browser's rendering process. This could lead to unauthorized access to the underlying operating system or user data beyond the browser's intended restrictions.
Technical details
This vulnerability is a use-after-free (CWE-416) within Skia, the 2D graphics library used by Google Chrome. The flaw is reachable via a crafted HTML page. An attacker who has already achieved code execution within the sandboxed renderer process can exploit this memory corruption issue to perform a sandbox escape, gaining elevated privileges on the host system. The issue was reported by Google researchers and is addressed in Chrome version 149.0.7827.103 for Windows and Mac, and 149.0.7827.102 for Linux.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-16: disclosed: Reported by Google researchers
- 2026-06-08: patched: Fixed in Chrome Stable channel update 149.0.7827.102/.103
- 2026-06-09: advisory: NVD publication date