CVE-2026-126858
Description
A flaw was found in chromium-browser. An uninitialized resource vulnerability in the Almost Native Graphics Layer Engine (ANGLE) allows a remote attacker to cause information disclosure. By convincing a victim to view a specially crafted HTML page, an attacker could read memory outside the security sandbox, potentially exposing sensitive data.
Statement
This vulnerability is rated as an Important impact because an attacker can achieve out-of-bounds information disclosure beyond the browser sandbox boundary if a user is persuaded to view malicious web content. Although the confidentiality compromise across trust domains warrants an elevated severity, exploitation requires active user interaction and specifically impacts Windows-targeted graphics translation within ANGLE. As a result, standard Red Hat Enterprise Linux environments do not utilize the vulnerable platform-specific subsystem under default configurations.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
