CVE-2026-9892: Inappropriate implementation in Skia in Google Chrome on Android prior to 148

Synopsis

A sandbox escape vulnerability exists in the Skia graphics library within Google Chrome on Android, affecting all versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, though the attacker must have already compromised the renderer process and needs the victim to visit a crafted HTML page. Successful exploitation breaks out of the Chrome sandbox, giving the attacker execution capabilities beyond the browser's normally isolated process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted device must be reachable by or able to reach the attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attack is initiated by luring the victim to a malicious page without any login step.

• Victim interactionRequired

  The victim must navigate to or load a crafted HTML page, meaning the attacker depends on a social-engineering step to trigger exploitation.

• Attack complexityDetail

  Exploitation requires the attacker to have already compromised the renderer process before the sandbox escape can be attempted, introducing a meaningful prerequisite beyond a single-step exploit.

Blast Radius

• A successful attacker breaks out of the Chrome sandbox on Android, gaining code execution in a more privileged process context outside the browser's isolation boundary.
• With sandbox constraints removed, the attacker reads sensitive data accessible to the host process, including stored credentials, cookies, and local application data.
• The attacker writes or modifies files and data stores reachable by the elevated process, enabling persistent changes to the device.
• The attacker can crash or destabilize the host process or dependent services, causing denial of service to the affected application.