CVE-2026-113126
Description
A flaw was found in chromium-browser. A memory corruption issue in the PolicyContainer component allows a remote attacker to execute arbitrary code outside the browser's restricted sandbox environment. To exploit this vulnerability, an attacker must convince a user to open a specially crafted HTML page. Successful exploitation could compromise the host system by bypassing standard browser security boundaries.
Statement
This vulnerability is classified as having an Important severity because it enables sandbox escape and arbitrary code execution on the host system, despite requiring user interaction to load untrusted web pages. Chromium is not packaged in core Red Hat Enterprise Linux releases, restricting potential exposure to environments deploying builds from Fedora or Extra Packages for Enterprise Linux (EPEL). Standard enterprise server installations without interactive desktop environments or browser usage are not affected.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
