Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T20:51:19 chromium-browser: Google Chrome: Arbitrary Code Execution via crafted file in Import component 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE-641

Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted file. (Chromium security severity: High)

A flaw was found in Google Chrome's Import component. A remote attacker, leveraging social engineering tactics, could exploit this vulnerability by tricking a user into processing a specially crafted file. Successful exploitation could lead to privilege elevation, allowing the attacker to potentially execute arbitrary code outside the browser's security sandbox.

Red Hat does not ship Google Chrome or Chromium as part of any supported Red Hat product. Chromium is available through EPEL, which is community-maintained and outside Red Hat's production support scope. Electron is shipped in some Red Hat products (podman-desktop, RHEL 10), but the affected Import component is Chrome browser-specific UI functionality not present in Electron's embedded Chromium engine. https://www.cve.org/CVERecord?id=CVE-2026-76018 https://nvd.nist.gov/vuln/detail/CVE-2026-76018 https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html https://issues.chromium.org/issues/513757918