Loading vulnerability…
Skia Out-of-Bounds Write Leading to Chrome Sandbox Escape
CVE-2026-19173 is an out-of-bounds write vulnerability in the Skia graphics component used by Google Chrome before version 151.0.7922.109. A remote attacker who has already compromised the renderer process could trigger the flaw through a crafted HTML page and potentially escape the browser sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and underlying memory-write conditions are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could breach browser sandbox isolation following renderer compromise, potentially enabling code execution or privilege escalation outside the renderer's restricted security context. The vulnerability is not described as providing initial renderer compromise or guaranteeing operating-system administrative privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, reduce exposure to untrusted web content in affected browsers and WebKitGTK applications, enforce least-privilege user accounts, and enable available exploit-protection controls. These measures reduce risk but do not correct the out-of-bounds write or reliably prevent sandbox escape.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later, restart the browser, and verify deployment across managed devices. For distribution-packaged Chromium or WebKitGTK containing affected Skia code, install the corresponding vendor security update. Listed fixed packages include Debian trixie chromium 151.0.7922.108-1~deb13u1, Debian trixie webkit2gtk 2.54.0-1~deb13u1, and RHEL 9 webkit2gtk3 2.54.0-1.el9_8.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.