CVE-2026-10012: Use after free in Skia in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Skia graphics library affects Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require the attacker to have already compromised the Chrome renderer process and to trick the victim into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker capabilities beyond the browser sandbox including potential code execution on the host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No credentials or account access are required to initiate the attack.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is high: the attacker must first have compromised the Chrome renderer process before this vulnerability can be leveraged for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• A successful attacker escapes the Chrome sandbox, gaining execution context outside the browser's isolation boundary.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files, becomes readable by the attacker.
• The attacker can write or modify data on the host system with the privileges of the browser process.
• The attacker can crash or disrupt the browser and potentially other processes on the host, causing service loss for the affected user.