The flaw lies in Skia, the graphics engine used by Chrome on Android. The library does not properly validate untrusted input from browser content, corresponding to CWE-20 and CWE-1289. A crafted HTML page can trigger the validator, enabling an attacker who already compromised the renderer process to escape the browser sandbox. If successful, the attacker could run code with the same privileges as the Chrome app or beyond.

Google Chrome for Android users running any version before 148.0.7778.216 are affected. The issue exists on the stable channel and earlier releases, so all Android devices that have not applied the latest update are vulnerable.

The CVSS score of 8.3 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. The attack requires that the attacker already runs arbitrary code in the renderer process – for example, by tricking the user into visiting a malicious website or through a cross‑site scripting vector. Once that condition is met, a crafted HTML page can trigger the Skia flaw to escape the sandbox. The combination of requirements means that exploitation is unlikely, but if it occurs the impact would be high, making timely remediation important.