CVE-2026-113131
Description
A flaw was found in the Bluetooth component of Chromium. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the browser's sandbox (an isolated execution environment) by tricking a user into visiting a specially crafted HTML page. The issue stems from memory corruption during the processing of Bluetooth interactions.
Statement
Red Hat Product Security rates this vulnerability as Important because an unauthenticated remote attacker could compromise the browser's sandboxed process without requiring elevated privileges if a user loads a malicious page. The chromium package is not distributed or supported within Red Hat Enterprise Linux core channels and is available only via community repositories like Fedora and EPEL. Furthermore, while the flaw permits execution within the browser sandbox, breaking out to compromise the host operating system would require chained vulnerabilities or bypassing kernel confinement.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
