Executive brief
A security vulnerability exists in Google Chrome's graphics engine, Skia. If a user visits a specially crafted website, an attacker who has already gained limited control over the browser's rendering process could bypass security boundaries (the sandbox) to gain broader access to the underlying system. This could lead to unauthorized data access or full system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the Skia component of Google Chrome. The flaw is reachable via a crafted HTML page and requires the attacker to have already compromised the renderer process. By exploiting this memory corruption issue, an attacker can achieve a sandbox escape, moving from the restricted renderer process to the more privileged browser process or the host operating system. The vulnerability is addressed in Chrome version 150.0.7871.125.
Affected products
- Google Chrome prior to 150.0.7871.125
Timeline
- 2026-07-03: disclosed: Reported to Google
- 2026-07-14: patched: Fixed in version 150.0.7871.125
- 2026-07-14: advisory