CVE-2026-113101
Description
A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the sandbox environment by convincing a user to open a specially crafted HTML page. This vulnerability is due to a use-after-free condition in the SiteIsolation component, which occurs when memory is accessed after it has already been released.
Statement
This vulnerability is rated as Important rather than Critical because, while an unauthenticated remote attacker can achieve code execution by enticing a user to visit an attacker-controlled web page, the execution is restricted to the browser's sandboxed renderer process and cannot compromise the host system without an additional escape mechanism. In standard Red Hat Enterprise Linux environments, exposure is significantly reduced as Chromium is not included in core platform repositories and is only available through community-maintained channels such as EPEL and Fedora. Consequently, systems running default enterprise installations without these community packages remain unaffected.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
