CVE-2026-113328
Description
A flaw was found in Google Chrome's Privacy component. Due to improper input validation, a remote attacker could convince a user to visit a crafted HTML page to execute arbitrary code outside the browser's security sandbox (an isolated execution environment). Successful exploitation could allow the attacker to bypass security boundaries and compromise the underlying system.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can escape the browser sandbox and execute arbitrary commands on the host system if an end user is tricked into viewing malicious web content. While the requirement for victim interaction prevents autonomous exploitation, a successful sandbox escape significantly expands the blast radius beyond the renderer process. The chromium package is not included in Red Hat Enterprise Linux core repositories and is only distributed through community channels such as Fedora and EPEL, meaning typical enterprise server deployments are not exposed.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles, extending the scope of the damage to higher-privileged users..
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
