CVE-2026-113041
Description
A flaw was found in the Actor component of Chromium. This vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox environment by tricking a user into visiting a crafted HTML page. The issue is caused by a use-after-free flaw, which occurs when the application attempts to access memory that has already been deallocated.
Statement
This vulnerability is rated as having an Important severity for Red Hat products because, while it permits unauthenticated remote code execution, exploitation is constrained to the client-side sandbox and requires explicit user interaction. Chromium is maintained through community channels such as Fedora and Extra Packages for Enterprise Linux (EPEL) and is not included in standard Red Hat Enterprise Linux server installations. Triggering this condition requires an active victim to load hostile web content, and compromised execution remains isolated within the renderer process boundaries unless chained with a secondary privilege escalation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
