---
id: "CVE-2026-126915"
page: "https://infrastack.ai/live/CVE-2026-126915"
kind: "vulnerability"
aliases: ["CVE-2026-126915"]
title: "Chrome on Android: uninitialized Skia variable lets crafted pages escape sandbox"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "browser", "chrome", "other"]
not_affected_if: ["chrome-up-to-date"]
published_at: "2026-11-11T23:17:21+00:00"
first_seen_at: "2026-11-11T23:29:40+00:00"
updated_at: "2026-11-11T23:31:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126915", "first_seen_at": "2026-11-11T23:29:40+00:00"}]
exploit_sources: []
---

# Chrome on Android: uninitialized Skia variable lets crafted pages escape sandbox

Link for people: https://infrastack.ai/live/CVE-2026-126915 (this .md is for agents)

Google Chrome on Android before 157.0.8103.78 has an uninitialized variable in the Skia graphics library. An attacker who has already compromised the renderer process via a crafted HTML page could potentially run arbitrary code outside the browser sandbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Chrome on Android and check the version under Settings > About Chrome; it should be `157.0.8103.78` or later.

## Fix

- Google Chrome on Android: `157.0.8103.78`

## Timeline

- 2026-11-11T23:29:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126915

## From the sources

Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_