UBUNTU-CVE-2026-119271: Use After Free
Published Nov 3, 2026
·Updated
Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
2 affected components
ubuntu/libskia*
ubuntu/libskia*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must persuade a user to load a crafted HTML page. Exploitation is remote and requires no attacker privileges, but it requires user interaction.
2
What is the impact of successful exploitation?
A successful exploit can allow arbitrary code execution inside the browser sandbox. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.
3
Which versions are known to be vulnerable?
Google Chrome versions prior to 156.0.8078.79 are described as affected. The provided data identifies ubuntu/libskia but does not specify the Ubuntu package versions containing a fix.