CVE-2026-9893: Use after free in Skia in Google Chrome prior to 148

Synopsis

Use-after-free in the Skia graphics library within Google Chrome (versions prior to 148.0.7778.216) is reachable over the network and requires no authentication, but does require the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation allows the attacker to escape Chrome's sandbox, gaining the ability to read, modify, or crash processes outside the browser's containment boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated network position.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making social engineering or a malicious link a necessary part of the attack chain.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must first compromise the Chrome renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• The attacker escapes Chrome's renderer sandbox, breaking out of the containment boundary intended to limit browser-process damage.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the browser process on the host system.
• The attacker can write or modify data on the host, including files and configuration accessible under the user's permissions.
• The attacker can crash or destabilize processes outside the browser sandbox, causing service disruption on the affected host.