CVE-2026-19173: High Out of bounds write in Skia
CVE-2026-19173 Out of bounds write in Skia
Other sources
Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 151.0.4129.78 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 151.0.7922.109
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-85043
- CVE-2026-102324
- CVE-2026-87499
- CVE-2026-85052
- CVE-2026-84324
- CVE-2026-103630
- CVE-2026-95372
- CVE-2026-95351
- CVE-2026-17657
- CVE-2026-91708
- CVE-2026-95339
- CVE-2026-79201
- CVE-2026-95310
- CVE-2026-95356
- CVE-2026-91737
- CVE-2026-79218
- CVE-2026-84325
- CVE-2026-91722
- CVE-2026-91724
- CVE-2026-91721
- CVE-2026-79219
- CVE-2026-19137
- CVE-2026-19170
- CVE-2026-87647
- CVE-2026-91736
- CVE-2026-87514
- CVE-2026-91716
- CVE-2026-95313
- CVE-2026-91749
- CVE-2026-84357
- CVE-2026-85051
- CVE-2026-85053
- CVE-2026-87628
- CVE-2026-17666
- CVE-2026-79195
- CVE-2026-84349
- CVE-2026-78954
- CVE-2026-79174
- CVE-2026-79187
- CVE-2026-79274
- CVE-2026-78952
- CVE-2026-79078
Frequently Asked Questions
What is the severity of CVE-2026-19173?
The severity of CVE-2026-19173 is classified as High.
How do I fix CVE-2026-19173?
To fix CVE-2026-19173, users should update Google Chrome to version 151.0.7922.109 or later.
What type of vulnerability is CVE-2026-19173?
CVE-2026-19173 is an out of bounds write vulnerability in Skia used by Google Chrome.
Can CVE-2026-19173 lead to a sandbox escape?
Yes, CVE-2026-19173 can allow a remote attacker to potentially perform a sandbox escape.
In which software is CVE-2026-19173 found?
CVE-2026-19173 is found in Google Chrome prior to version 151.0.7922.109.