CVE-2026-113019
Description
A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser sandbox by convincing a user to open a specially crafted HTML page. This vulnerability is caused by a use-after-free condition in the Turbolev component, where the application references memory after it has been released.
Statement
This vulnerability is rated as Important severity rather than Critical because successful exploitation requires user interaction to load untrusted web content and remains confined within the browser's sandbox environment. Chromium is not included in core Red Hat Enterprise Linux releases and is only provided through Extra Packages for Enterprise Linux (EPEL) and Fedora. While an attacker can achieve arbitrary execution inside the renderer process, compromising the host system would require chaining this flaw with a sandbox escape.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
