CVE-2026-10020: Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148

Synopsis

This is a sandbox escape vulnerability in the Skia graphics library within Google Chrome on Android, affecting versions prior to 148.0.7778.216. It is reachable over the network and requires no authentication, but does require a victim to interact with a crafted HTML page, and the attacker must have already compromised the renderer process. Successful exploitation allows the attacker to break out of the Chrome sandbox and execute code with elevated privileges on the host device. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target device must be reachable or the user must browse to an attacker-controlled resource over the internet.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must already have compromised the renderer process before the sandbox escape step, introducing a significant prerequisite condition.

Blast Radius

• An attacker who successfully escapes the sandbox gains code execution outside Chrome's sandboxed renderer, bypassing the isolation boundary intended to contain browser-level compromises.
• Confidential data accessible to the Chrome process on the device, including stored credentials, cookies, and session tokens, becomes readable to the attacker.
• The attacker gains the ability to write to or modify data on the device at the privilege level of the Chrome process, enabling persistent file-system changes.
• The attacker can crash or disrupt the Chrome process and potentially other device services reachable from the escaped sandbox context.