CVE-2026-113239
Description
A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution within the browser's restricted sandbox environment by enticing a user to visit a specially crafted HTML page. The issue stems from a range validation error in the SiteIsolation component.
Statement
Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can trigger arbitrary code execution through user interaction, though the blast radius is constrained within the process sandbox. Chromium is not packaged or shipped within core Red Hat Enterprise Linux repositories, appearing only in community-supported channels like EPEL and Fedora. As a result, standard enterprise server environments remain unaffected by default.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles, extending the scope of the damage to higher-privileged users..
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
