CVE-2026-113298
Description
A flaw was found in the Transactions Platform component of Chromium. This vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox. By persuading a user to visit a specially crafted HTML page, an attacker can trigger a use-after-free error, which occurs when memory is accessed after it has already been freed.
Statement
This vulnerability is rated as Important because an unauthenticated remote adversary can achieve arbitrary code execution inside the client process sandbox if a user is enticed to navigate to a malicious webpage. Although severe, the blast radius is constrained by the browser's sandboxing mechanism, which prevents direct access to the underlying operating system without a secondary sandbox escape. Chromium is not included in Red Hat Enterprise Linux core repositories and is only distributed through community channels such as Fedora and Extra Packages for Enterprise Linux (EPEL), leaving standard enterprise deployments unaffected by default.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
