CVE-2026-121173
Description
An uninitialized resource flaw was found in the WebGL component of the Chromium browser.
Upstream bug(s):
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable WebGL rendering in browser deployments accessing untrusted web content: upgrade to Google Chrome 157.0.8103.38 (or the fixed Chromium builds), which initializes WebGL memory resources prior to access to prevent reading memory outside the sandbox, closing crafted HTML page. Until patched, this is a concern on Chromium browser installations with WebGL enabled, so disable WebGL rendering in browser policies or restrict users from visiting untrusted web pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying uninitialized resource flaw — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
