CVE-2026-113229
Description
A flaw was found in the Loader component of chromium-browser. A remote attacker can exploit a use-after-free memory vulnerability by enticing a user to open a specially crafted HTML page. Successful exploitation allows an attacker to execute arbitrary code within the browser sandbox environment.
Statement
Red Hat Product Security rates this vulnerability as Important rather than Moderate because an unauthenticated remote adversary can achieve arbitrary code execution inside the renderer process by luring a user to a malicious webpage. Although the browser's default sandboxing prevents direct access to the operating system and necessitates a secondary vulnerability for a complete host escape, the ability to remotely execute code within the isolated session poses significant integrity and confidentiality risks to user browsing data. Chromium packages are not included in core Red Hat Enterprise Linux offerings and are only maintained through community channels such as EPEL and Fedora.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
