CVE-2026-113040
Description
A flaw was found in the Proxy component of the Chromium browser. Due to improper input validation, a remote attacker could exploit this vulnerability by enticing a user to view a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the browser's sandbox (an isolated security environment).
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can trigger arbitrary code execution within the browser's sandbox if a user navigates to a malicious webpage. While the blast radius is initially constrained by sandboxing controls and requires user interaction, successful exploitation permits full code execution inside the affected rendering process. Chromium is not shipped in standard Red Hat Enterprise Linux channels, limiting deployment to environments enabling community repositories such as EPEL.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When input does not comply with the expected type, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities that would not be possible if the input conformed with the expected type.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
