CVE-2026-110143
Description
An use of uninitialized variable flaw was found in the ThirdParty lmza_sdk component of the Chromium browser.
Upstream bug(s):
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Varies by Context; Read Application Data
Uninitialized variables usually contain junk, which can not be trusted for consistency. Depending on the context, uninitialized variables could lead to denial of service conditions, or modify control flow in unexpected ways. They could also contain sensitive information that could be leaked if the variable is used in output. In some cases, an attacker can "pre-initialize" the variable using previous actions - i.e., control the contents of the variable - which might enable code execution.
Availability
Technical Impact: Alter Execution Logic; Unexpected State
This can cause a race condition if a lock variable check passes when it should not.
Authorization,Other
Technical Impact: Varies by Context
Strings that are not initialized are especially dangerous, since many functions expect a null at the end -- and only at the end -- of a string.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
