CVE-2026-126846: Use after free in Skia
Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.78
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-126885
- CVE-2026-126895
- CVE-2026-126879
- CVE-2026-126911
- CVE-2026-126864
- CVE-2026-126889
- CVE-2026-126859
- CVE-2026-126886
- CVE-2026-126887
- CVE-2026-126870
- CVE-2026-126912
- CVE-2026-126919
- CVE-2026-126878
- CVE-2026-126909
- CVE-2026-126847
- CVE-2026-126853
- CVE-2026-126865
- CVE-2026-126916
- CVE-2026-126903
- CVE-2026-126910
- CVE-2026-126842
- CVE-2026-126898
- CVE-2026-126871
- CVE-2026-126875
- CVE-2026-126862
- CVE-2026-126900
- CVE-2026-126904
- CVE-2026-126907
- CVE-2026-126851
- CVE-2026-126845
- CVE-2026-126881
- CVE-2026-126867
- CVE-2026-126863
- CVE-2026-126896
- CVE-2026-126869
- CVE-2026-126858
- CVE-2026-126891
- CVE-2026-126874
- CVE-2026-126876
- CVE-2026-126918
- CVE-2026-126866
- CVE-2026-126844
- CVE-2026-126884
- CVE-2026-126894
- CVE-2026-126861
- CVE-2026-126917
- CVE-2026-126856
- CVE-2026-126905
- CVE-2026-126873
- CVE-2026-126922
- CVE-2026-126914
- CVE-2026-126880
- CVE-2026-126872
- CVE-2026-126877
- CVE-2026-126888
- CVE-2026-126843
- CVE-2026-126854
- CVE-2026-126892
- CVE-2026-126897
- CVE-2026-126857
- CVE-2026-126883
- CVE-2026-126840
- CVE-2026-126848
- CVE-2026-126882
- CVE-2026-126906
- CVE-2026-126915
- CVE-2026-126893
- CVE-2026-126855
- CVE-2026-126908
- CVE-2026-126849
- CVE-2026-126901
- CVE-2026-126852
- CVE-2026-126850
- CVE-2026-126841
- CVE-2026-126902
- CVE-2026-126868
- CVE-2026-126921
- CVE-2026-126913
- CVE-2026-126890
- CVE-2026-126860
- CVE-2026-126920
- CVE-2026-126899
Frequently Asked Questions
Which Chrome installations are affected?
Google Chrome on Android prior to version 157.0.8103.78 is affected. The provided information does not identify impact on other platforms.
What does an attacker need to exploit this issue?
An attacker needs to induce the target to process a crafted HTML page remotely. Successful exploitation can execute arbitrary code outside Chrome's sandbox.
How can I determine whether a device is vulnerable?
Check the installed Google Chrome version on the Android device. Versions earlier than 157.0.8103.78 are affected according to the provided information.