CVE-2026-113300
Description
A flaw was found in the Forms component of chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution outside of the browser security sandbox. By tricking a user into visiting a specially crafted HTML page, an attacker can trigger an out-of-bounds memory write to compromise the host system.
Statement
Chromium is not included directly in core Red Hat Enterprise Linux releases and is maintained primarily through community channels such as EPEL. This flaw is rated with an Important impact because, while exploitation requires user interaction to visit a malicious site, successful compromise can bypass browser sandbox constraints to execute arbitrary code with the user's privileges. Systems running headless server environments without desktop browser usage are not exposed.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
