Quick Look: CVE-2026-6304 — Use After Free in Chrome's Skia Graphite Enables Sandbox Escape

Introduction

A use-after-free vulnerability in Google Chrome's Skia Graphite GPU rasterization backend can allow an attacker who has already compromised the renderer process to escape Chrome's sandbox entirely and reach the underlying operating system. Chrome holds roughly 66.7 percent of the global desktop browser market, so CVE-2026-6304 is a significant exposure for virtually every enterprise environment.

Technical Information

Root Cause: Use After Free in the Graphite Rasterization Pipeline

CVE-2026-6304 is a use-after-free (CWE-416) memory corruption vulnerability in the Graphite component of Google Chrome. Graphite is Skia's next-generation GPU rasterization backend, purpose-built to replace the legacy Ganesh backend. It is designed around modern graphics APIs including Vulkan, Metal, and Direct3D 12, and it converts paint commands from the Blink rendering engine into the pixels displayed on screen.

A use-after-free condition arises when a program keeps referencing a pointer after the memory it addresses has been deallocated. If the freed memory is later reallocated for a different purpose, the dangling pointer can be used to read or write arbitrary data, which may allow code execution. In this case, an object within the Graphite rasterization pipeline was accessed after it had been freed, and that access is the exploitable condition.

Why Graphite Makes This Particularly Dangerous

Where Graphite runs is what raises the severity of this bug. In Chrome's multi-process architecture, Graphite runs in the GPU process, which has broader system privileges than the highly sandboxed renderer process. The renderer sandbox is one of Chrome's primary security boundaries, designed to contain the impact of memory corruption bugs in web content processing. A use after free in the GPU process sits on the other side of that boundary. An attacker who can trigger the bug from a compromised renderer effectively crosses from a restricted environment into a more privileged one.

The CVSS 3.1 vector reflects this: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, with a base score of 8.3 (HIGH). The "Scope: Changed" designation captures the crossing of that trust boundary.

Attack Flow

Exploiting CVE-2026-6304 takes two stages:

1. The attacker first compromises Chrome's renderer process. This is a precondition, not part of CVE-2026-6304 itself, and would typically be achieved through a separate vulnerability, such as a type confusion or buffer overflow in V8 or Blink. The renderer parses and executes web content, which makes it a frequent target for memory corruption exploits delivered through malicious web pages.

2. From the compromised renderer, the attacker delivers a crafted HTML page (or manipulates rendering commands) that triggers the use-after-free condition in the Graphite rasterization pipeline, which runs in the GPU process. The GPU process runs outside the renderer sandbox with elevated privileges, so successful exploitation lets the attacker escape the sandbox and interact with the underlying operating system.

Needing a prior renderer compromise raises the attack complexity, which is why the CVSS vector specifies AC:H. In practice, though, renderer compromises are a well-understood class of attack, and chaining two vulnerabilities for a full sandbox escape is a standard technique in browser exploitation.

Graphite and Skia Architecture Context

Skia is the graphics engine Google Chrome uses to render paint commands from Blink and the browser UI into pixels. The Graphite backend was introduced to modernize Skia, and for Chrome's implementation Google chose Dawn (Chrome's WebGPU implementation) as the abstraction layer for platform-native graphics APIs. Graphite therefore sits where the rendering pipeline meets the GPU hardware abstraction layer.

Patch Information

Google fixed CVE-2026-6304 in a stable channel update released on April 15, 2026. The patched versions are:

All Chrome versions prior to 147.0.7727.101 are vulnerable.

This was a point release aimed at security fixes, following the initial Chrome 147.0.7727.55 stable release (April 7, 2026). It includes 31 security fixes in total. The patch shipped eight days after that initial stable release, which indicates that the Chrome security team treated this vulnerability with urgency.

The patch corrects the memory management defect that allowed a freed object within the Graphite rasterization pipeline to be accessed. The code-level details of the fix are not publicly available. The associated Chromium bug report (Issue 496393742) remains access restricted, which is standard practice for Chrome security bugs until the majority of users have updated.

Downstream Chromium browsers: Graphite is part of the core Skia graphics library shared across all Chromium-based browsers, so downstream browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will need to ship the upstream Chromium fix in their own release trains. Administrators should check every Chromium-derived browser in their environment, not only Chrome, and confirm that each one is updated past this fix.

Enterprise administrators should not rely on Chrome's automatic staged rollout. Push the update through enterprise MDM or software deployment tooling instead, to keep the vulnerability window as short as possible.

Affected Systems and Versions

All Google Chrome desktop versions prior to 147.0.7727.101 are affected. This includes:

• Google Chrome for Windows (versions before 147.0.7727.101)
• Google Chrome for macOS (versions before 147.0.7727.101)
• Google Chrome for Linux (versions before 147.0.7727.101)
• Google Chrome for Android (versions before 147.0.7727.101)

The vulnerability is in the Skia Graphite component, which is shared across the Chromium codebase. Every Chromium-based browser that has adopted the Graphite backend is therefore potentially affected until it ships the upstream fix. This includes Microsoft Edge, Brave, Opera, and Vivaldi.

Vendor Security History

Google has a dedicated Chromium security team and a well-established Vulnerability Reward Program. Its disclosure policy restricts access to bug details and links until a majority of users have the fix, and security bugs automatically become public 14 weeks after they are fixed.

Google reported CVE-2026-6304 internally on March 26, 2026 and patched it on April 15, 2026, a 20-day turnaround from report to fix for a high-severity issue. Use-after-free vulnerabilities are a recurring class of bug in Chrome. The Chromium project has been investing in memory safety improvements (including Rust adoption and MiraclePtr) to make them less frequent over time.

References

• NVD: CVE-2026-6304
• CVE Record: CVE-2026-6304
• Chrome Releases: Stable Channel Update for Desktop (April 15, 2026)
• Chromium Issue 496393742
• Introducing Skia Graphite: Chrome's Rasterization Backend
• Skia Documentation
• Chromium Security
• CISA Known Exploited Vulnerabilities Catalog
• Browser Market Share Worldwide (StatCounter)