Loading vulnerability…
Skia use-after-free sandbox escape in Google Chrome on Android
CVE-2026-19154 is a use-after-free vulnerability in the Skia graphics library in Google Chrome on Android before version 151.0.7922.109. A remote attacker who has already compromised the renderer process can potentially trigger the vulnerability through a crafted HTML page to escape the browser sandbox. Chromium classifies the vulnerability as Critical. The specific vulnerable function has not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could breach the renderer sandbox boundary, extending an existing renderer compromise beyond its intended isolation. The resulting privileges and accessible resources are not specified. This vulnerability does not establish an initial renderer compromise by itself.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until the update is deployed, restrict exposure to untrusted web content. This reduces exposure but does not remove the vulnerability or reliably prevent exploitation from an already-compromised renderer.
Patch, then assume compromise.
Upgrade Google Chrome on Android to version 151.0.7922.109 or later and restart the browser to activate the update. Verify deployment across managed devices rather than relying solely on automatic-update settings.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.