CVE-2026-13885: Chrome Android Sandbox Escape via Skia Use-After-Free

Technical summary

CVE-2026-13885 is a use-after-free flaw (CWE-416) in the Skia graphics engine bundled with Google Chrome on Android. The vulnerability arises from improper memory management where freed memory is accessed after deallocation, typically during graphics rendering operations. A remote, unauthenticated attacker can trigger this by serving a specially crafted HTML page. The attack requires user interaction (visiting the page) but no special privileges. The flaw affects Chrome for Android versions before 150.0.7871.47. Google's Chromium security team classified this as Medium severity from a browser perspective, though the CVSS 3.1 score of 8.8 reflects the high impact if the sandbox is compromised.

Business impact

This vulnerability directly threatens organizations and individuals using Chrome on Android devices—a massive attack surface given Chrome's market dominance on mobile. A successful breach of the Chrome sandbox could grant attackers access to device data, contacts, browsing history, authentication tokens, and sensitive application data stored on the phone. For enterprises with mobile workforces or BYOD policies, this represents both a direct endpoint compromise risk and a potential pivot point into corporate networks. The requirement for user interaction (clicking a link or visiting a malicious website) is a practical barrier, but phishing, compromised websites, or drive-by downloads make exploitation realistic at scale.

Affected systems

Google Chrome for Android prior to version 150.0.7871.47 is the primary affected component. The vulnerability is specific to the Skia graphics rendering library within Chrome and does not directly affect the Android OS itself, though a sandbox escape could compromise the device. Chrome for desktop and iOS are not mentioned as affected. Organizations should inventory Chrome installations on Android devices, including both corporate-managed and employee-owned devices accessing corporate resources.

Exploitability

Exploitation requires user interaction (visiting a crafted HTML page), which prevents worm-like propagation but does not materially lower risk given the ubiquity of web browsing. The attack vector is network-based with no authentication required. No exploit code has been publicly disclosed or added to CISA's KEV catalog as of this writing, suggesting active exploitation in the wild is not yet confirmed. However, the relative simplicity of HTML-based attack delivery and the high impact of sandbox escape make this a natural target for exploit development by threat actors.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later immediately. Users should enable automatic updates in the Google Play Store settings to ensure patches are applied promptly upon release. For organizations managing Android devices via MDM (Mobile Device Management) solutions, deploy mandatory Chrome version policies to enforce minimum patched versions. Test updates in a small subset of devices first to rule out compatibility issues with legacy applications or custom ROMs.

Patch guidance

Verify that Chrome on Android has been updated to 150.0.7871.47 or newer. In the Google Play Store, navigate to 'My apps & games,' select Chrome, and confirm the installed version matches or exceeds the patched build. For managed environments, use your MDM console to push Chrome updates and enforce version compliance across the fleet. Confirm patching within 7–14 days given the sandbox-escape risk and the simplicity of exploitation vector. Users on older Android versions or custom ROMs who cannot receive updates through the Play Store should consult their device manufacturer or use alternative browsers until an update is available.

Detection guidance

Monitor for unusual Chrome process behavior, particularly graphics rendering crashes or unexpected child process spawns on Android devices. In a managed environment, look for devices still running Chrome versions below 150.0.7871.47 using your MDM reporting tools. Network detection is challenging since the attack is delivered via HTTPS; however, threat intelligence feeds may identify malicious domains hosting the crafted HTML payloads. Endpoint detection and response (EDR) tools with mobile support should flag attempts to escape Chrome's sandbox or unusual file system access patterns from the Chrome process.

Why prioritize this

This vulnerability merits immediate attention despite the lack of confirmed active exploitation. The combination of high CVSS impact (8.8), low attack complexity, no authentication requirement, and the sandbox-escape potential makes it an attractive target. The reliance on user interaction is a practical constraint but not a security control; phishing or compromised websites provide reliable delivery mechanisms. Organizations with significant Android user bases or remote workers using personal Chrome should prioritize patching within days rather than weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible flaw with no privilege or authentication requirement that compromises confidentiality, integrity, and availability. The use-after-free bug carries inherent unpredictability (attackers cannot reliably predict memory layout), but motivated threat actors often succeed through heap spray techniques or repeated triggering. The score appropriately escalates from Chromium's Medium classification because the sandbox—while present—is not guaranteed to hold if exploited successfully, exposing the entire device to compromise.

Frequently asked questions