External risk intelligence

Chrome for Android Skia Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-126846

This vulnerability exists in the Skia graphics library within Google Chrome on Android. Browsers are client-side software designed to process remote, untrusted content from the internet. Because the primary function of a web browser is to render external web pages, it is a commonly exposed surface that routinely interacts with the public internet.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Skia graphics library used by Google Chrome on Android could allow attackers to execute code outside the browser's safety zone through malicious web pages. This means that simply visiting a compromised website could potentially expose users to the risk of arbitrary code execution.

Flaw in graphics code can let bad actors run their own code.
Critical flaw means widespread potential for remote code execution.
Confirm relevance and exposure to ensure business continuity.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which would then target a flaw in the Skia graphics engine used by Chrome on Android. This could allow the attacker to run their own code on the device, potentially bypassing security restrictions and leading to further compromise.

Requires a user to visit a malicious webpage.
Exploits a use-after-free flaw in Skia.
Risk of arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Skia graphics component of Google Chrome on Android could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a crafted HTML page.

Arbitrary code execution outside sandbox.
Exploited via crafted HTML page.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Skia graphics library within Google Chrome on Android requires immediate attention from teams responsible for end-user device security and browser management. The first step is to identify all Android devices running Chrome, confirm their exposure to untrusted HTML content, and locate the accountable owner for these devices to coordinate a targeted remediation plan.

Browser and mobile platform owners should investigate.
Verify Chrome browser reachability and criticality.
Plan updates and risk mitigation measures.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Skia graphics library in Google Chrome?

Skia is an open-source 2D graphics engine that provides the core drawing capabilities for Google Chrome. It handles everything from rendering text and images to drawing the complex shapes and animations you see on web pages. Because it processes untrusted content from websites, it is a critical component for browser security.

What does a use-after-free weakness mean in CVE-2026-126846?

A use-after-free is a memory management error. It occurs when a program continues to use a memory location after that memory has been cleared or released. In this specific vulnerability, an attacker can manipulate this flaw to replace the freed memory with their own data, effectively tricking the browser into executing unauthorized code.

How does an attacker trigger this Chrome vulnerability?

An attacker triggers this flaw by luring a user to a specially crafted HTML page. The browser processes this malicious content, which then activates the faulty memory handling in Skia. Simply opening a standard, benign website will not trigger the bug; the page must be specifically designed to exploit this memory state.

Why is this CVE concerning for Chrome on Android?

According to Halo Surface Signal, this vulnerability is particularly relevant because Chrome is designed to interact directly with the public internet. Because the browser regularly parses untrusted content, the risk of encountering a crafted page is higher for internet-facing devices compared to those restricted to internal, controlled environments.

Do I need to update my devices to address this issue?

Yes. Since this vulnerability allows for code execution outside the browser's safety sandbox, you should prioritize updates. Start by creating an inventory of Android devices running Chrome, identifying the responsible owners, and coordinating a roll-out of the latest browser version provided by the vendor to remediate the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.