CVE-2026-113094
Description
A flaw was found in chromium-browser. A remote attacker can trigger memory corruption in the application programming interface (API) by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code within the browser's sandbox environment.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can achieve arbitrary code execution within the constrained rendering process if a user is convinced to visit malicious web content. Although the browser sandbox restricts direct host compromise unless chained with an escape exploit, executing unauthorized instructions inside the renderer presents substantial confidentiality and integrity risks. In Red Hat ecosystems, Chromium is distributed via Fedora and Extra Packages for Enterprise Linux (EPEL) as an optional desktop browser rather than a core system service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
