This vulnerability involves an inappropriate implementation in the Skia graphics library within Google Chrome on Android. Specifically, it allows an attacker who has already compromised the renderer process to potentially perform a sandbox escape by delivering a crafted HTML page. The issue affects Chrome versions prior to 148.0.7778.216. The sandbox escape could allow the attacker to break out of the restricted environment of the renderer process, potentially leading to greater control over the device. The vulnerability was disclosed on May 28, 2026, and is classified as critical by Chromium security. The vendor advisory linked is a stable channel update announcement, which likely includes the fix for this issue.

If exploited, this vulnerability could allow an attacker with control over the renderer process to escape the sandbox, potentially leading to execution of arbitrary code with higher privileges on the affected Android device. This elevates the risk from a renderer compromise to a full sandbox escape, increasing the severity of an attack. No known exploits in the wild have been reported, reducing immediate risk. The impact is limited to affected versions of Google Chrome on Android prior to 148.0.7778.216.

A fix is available in Google Chrome version 148.0.7778.216 and later. Users and administrators should update affected Chrome installations on Android to this version or newer to remediate the vulnerability. The vendor advisory linked is a stable channel update announcement, which confirms the availability of the fix. No additional mitigation steps are indicated by the vendor advisory.