CVE-2026-113235
Description
A flaw was found in the Passwords component of chromium-browser. An improper input validation vulnerability allows a remote attacker to potentially execute arbitrary code outside of the browser's isolated security environment (sandbox). To exploit this vulnerability, an attacker must trick a user into opening a specially crafted web page.
Statement
This vulnerability is evaluated with an Important severity rating because escaping the browser's containment boundary to run arbitrary host-level code presents a critical compromise to system confidentiality, integrity, and availability. While the blast radius extends beyond the isolated browsing context, successful attacks depend on user interaction, requiring a target to load a maliciously crafted web destination. In Red Hat environments, Chromium is not distributed as part of core Red Hat Enterprise Linux offerings, being packaged exclusively in community repositories like Fedora and EPEL.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles, extending the scope of the damage to higher-privileged users..
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
