CVE-2026-126875
Description
A flaw was found in chromium-browser. Missing authorization checks in the V8 engine allow a remote attacker to bypass web origin security boundaries by convincing a victim to load a specially crafted HTML page. Successful exploitation could lead to information disclosure by allowing unauthorized access to sensitive data across different websites.
Statement
This vulnerability is rated as an Important severity flaw because an attacker can circumvent the same-origin security boundary remotely, compromising the confidentiality and integrity of web sessions without requiring elevated privileges. In Red Hat Enterprise Linux environments, chromium-browser is primarily deployed as an optional desktop application for interactive web browsing. Exploitation requires user interaction to visit an attacker-controlled website or load untrusted web content. Standard operating system sandboxing mechanisms do not prevent cross-origin authorization failures within the JavaScript engine once malicious content is processed.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
