CVE-2026-113160
Description
A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser sandbox by enticing a victim to visit a specially crafted HTML page. This vulnerability stems from a use-after-free condition in the Turbolev component, which occurs when the application attempts to access memory after it has already been released.
Statement
In Red Hat environments where Chromium is deployed, this vulnerability is evaluated with an Important severity because remote code execution is constrained within the browser's sandboxed renderer process rather than granting direct host system access. While attackers could trigger memory corruption by convincing a user to open a hostile web page, the prerequisite user interaction and sandbox containment prevent an unassisted full operating system compromise. Exploitation would require pairing this issue with a separate sandbox escape to affect the underlying host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
