CVE-2026-113020
Description
A flaw was found in chromium-browser. Due to improper input validation in the Date component, a remote attacker can execute arbitrary code outside the browser's restricted sandbox environment by convincing a user to visit a specially crafted HTML page. Successful exploitation could compromise the underlying host system.
Statement
This vulnerability is rated as having Important impact because, although it allows remote code execution that escapes sandbox isolation, exploitation strictly requires user interaction to visit a malicious website. Red Hat Enterprise Linux does not include or maintain the Chromium browser in its core product channels, restricting enterprise exposure to systems where community packages are installed. In environments where the package is actively used, an attacker could run arbitrary commands with the privileges of the logged-in user.
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
