CVE-2026-7920: Google Chrome Use After Free Vulnerability

CVE-2026-7920 Overview

CVE-2026-7920 is a use-after-free vulnerability in the Skia graphics library used by Google Chrome versions prior to 148.0.7778.96. The flaw allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Skia handles 2D graphics rendering across Chrome on Windows, macOS, and Linux, making the impact cross-platform. Google rates the Chromium security severity as High [CWE-416].

Critical Impact
An attacker who controls a renderer process can leverage the Skia use-after-free to break out of the Chrome sandbox, escalating from web content execution to broader system access on Windows, macOS, and Linux hosts.

Affected Products

Google Chrome versions prior to 148.0.7778.96
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-05-06 - CVE-2026-7920 published to NVD
2026-05-06 - Last updated in NVD database
2026-05 - Google releases stable channel update for desktop addressing the issue

Technical Details for CVE-2026-7920

Vulnerability Analysis

The vulnerability is a use-after-free condition in Skia, the 2D graphics library Chrome uses for rasterization, canvas rendering, and compositing. A use-after-free occurs when memory is referenced after it has been deallocated, allowing an attacker to control the contents of the freed object on subsequent reuse. In the context of Skia, attacker-controlled HTML or canvas content can drive the renderer into a state where a freed graphics object is accessed during rendering operations.

Exploitation requires the attacker to first compromise the renderer process. Once inside the sandboxed renderer, the attacker triggers the Skia flaw to corrupt memory and pivot toward a sandbox escape. A successful escape moves code execution out of the restricted renderer context and into the broader browser process privileges. Additional technical context is available in the Chromium Issue Tracker #498989348.

Root Cause

The root cause is improper object lifetime management within Skia, classified as [CWE-416] Use After Free. A pointer to a freed graphics resource remains accessible to rendering code paths reachable from JavaScript, HTML, and CSS, which allows reallocation of the freed slot with attacker-influenced data before it is dereferenced.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a crafted HTML page in a vulnerable Chrome build. The attacker must already have achieved code execution in the renderer process, typically by chaining this issue with a separate renderer-side vulnerability. The scope is changed because successful exploitation crosses the renderer sandbox boundary.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing exists for CVE-2026-7920 at the time of publication.

Detection Methods for CVE-2026-7920

Indicators of Compromise

Chrome renderer or browser process crashes referencing Skia modules such as libskia or skia.dll in crash dumps.
Unexpected child processes spawned by chrome.exe or the browser process following navigation to untrusted sites.
Outbound connections from the Chrome browser process to attacker-controlled infrastructure shortly after rendering an unfamiliar HTML page.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 148.0.7778.96.
Hunt for anomalous process trees where Chrome spawns shells, scripting engines, or LOLBins after browsing activity.
Correlate browser crash telemetry with subsequent persistence or credential-access behavior on the same host.

Monitoring Recommendations

Forward Chrome crash reports and EDR process telemetry to a central data lake for behavioral correlation.
Monitor for execution of binaries written to user-writable paths immediately after Chrome activity.
Track DNS and proxy logs for navigation to newly registered or low-reputation domains preceding renderer crashes.

How to Mitigate CVE-2026-7920

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded into running sessions.
Verify managed deployments by checking chrome://settings/help or enterprise update reporting.

Patch Information

Google addressed CVE-2026-7920 in the Chrome stable channel update for desktop. Administrators should consult the Google Chrome Stable Update advisory and upgrade to 148.0.7778.96 or newer. Chromium-based browsers that embed the same Skia version should apply vendor updates that incorporate the upstream fix.

Workarounds

Enforce Chrome auto-update via enterprise policy to ensure rapid rollout of the fixed build.
Restrict browsing to trusted sites using web filtering or proxy controls until patches are deployed.
Apply site isolation and strict sandbox policies, and consider disabling hardware acceleration to reduce Skia attack surface as a temporary measure.

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy to enforce auto-update (Linux example)
echo '{"DefaultBrowserSettingEnabled": true, "ComponentUpdatesEnabled": true}' \
  | sudo tee /etc/opt/chrome/policies/managed/auto_update.json