Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT

Google Chrome2026-10-30 01:16 UTC1 min readRead in

Summary

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Remediation

Inventory every Google Chrome deployment, including staging.
Upgrade Google Chrome to 156.0.8078.79.
Confirm the running version after the upgrade.

References

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
– <156.0.8078.79	156.0.8078.79

Weakness

CWE-416

Exploit probability (EPSS)

0.2%

Timeline

2026-10-30Publicly disclosed

Sources

NVD