This vulnerability involves an out-of-bounds read in the Skia graphics library used by Google Chrome. Specifically, versions of Chrome prior to 151.0.7922.72 are affected. An attacker who has compromised the renderer process could leverage this flaw to perform a sandbox escape, increasing the potential impact of an existing compromise. The CVSS v3.1 base score is 5.8, reflecting medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with control over the renderer process to escape the Chrome sandbox, potentially leading to greater system compromise beyond the browser sandbox. The impact on confidentiality, integrity, and availability is rated low, but the sandbox escape capability increases the risk of further exploitation.

Users should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability is fixed. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html confirms the availability of this update. There are no known workarounds or temporary mitigations; applying the official update is the recommended action.