CVE-2026-102331
Description
A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE (Almost Native Graphics Engine) component. An attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page.
Statement
This vulnerability is rated as Important rather than Critical because impact is constrained to the application utilizing the rendering library. In Red Hat Enterprise Linux, this flaw primarily affects WebKitGTK due to its embedded ANGLE graphics translation component, whereas standalone web browsers such as Firefox are not affected. Triggering the underlying memory corruption requires enticing a user into rendering a maliciously crafted webpage, preventing unauthenticated automated exploitation.
Mitigation
Avoid opening untrusted web content or navigating to unverified web pages within applications relying on WebKitGTK or Chromium.
Where feasible, execute web-rendering applications inside restricted containers or sandboxes with minimal user privileges to constrain the impact of potential code execution.
If web rendering is not required on server installations, remove optional packages providing WebKitGTK (such as webkit2gtk3 or webkitgtk4).
Caveat: Removing WebKitGTK packages may remove dependent graphical components, including parts of desktop environments like GNOME. Headless server operations and terminal access will remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.6 | N/A | 9.6 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
