CVE-2026-113168
Description
A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the browser's sandbox environment by convincing a user to visit a specially crafted HTML page. This vulnerability is caused by a use-after-free memory issue in the Permissions component.
Statement
Red Hat rates this flaw as Important severity because an unauthenticated remote attacker can achieve code execution if a user visits a hostile webpage, even though execution remains constrained within the renderer sandbox. While this risk is elevated by the lack of network authentication requirements, exploitation still necessitates social engineering to induce user interaction. Furthermore, Chromium is not shipped in core Red Hat Enterprise Linux channels and is only available through community repositories such as EPEL and Fedora, leaving standard enterprise server deployments unaffected by default.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
