Loading vulnerability…
Sandbox Escape via Use-After-Free in Chrome Skia
CVE-2026-17653 is a use-after-free vulnerability in the Skia graphics component of Google Chrome before version 151.0.7922.72. A remote attacker that has already compromised the Chrome renderer process may use a crafted HTML page to potentially escape Chrome's sandbox.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can potentially allow an attacker to escape the Chrome sandbox after renderer-process compromise, bypassing a browser security boundary and enabling further compromise beyond the renderer sandbox.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is specified. Until updates can be deployed, reduce exposure to untrusted web content, enforce least privilege for browser users, retain browser sandboxing and application-isolation controls, and restrict unnecessary browser extensions.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.72 or later. Vendor-supported Chrome 151 builds should be updated promptly through the normal update mechanism.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.