CVE-2026-113063
Description
A flaw was found in the Chromoting component of chromium-browser. Due to improper input validation, a remote attacker can achieve arbitrary code execution inside the browser sandbox by tricking a user into visiting a crafted HTML page. Successful exploitation allows unauthorized code to run within the restricted sandbox environment, potentially compromising the user's active session.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can achieve arbitrary code execution without requiring elevated privileges, relying solely on user interaction to view a malicious web page. In Red Hat environments, exposure is limited as the chromium browser is not shipped in Red Hat Enterprise Linux core channels, being available only through community repositories such as Fedora and EPEL. Additionally, the blast radius is restricted because execution is confined within the browser's sandbox, preventing direct access to host system resources in the absence of a secondary sandbox escape.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
