CVE-2026-126903
Description
A flaw was found in the ANGLE graphics component of chromium-browser. Due to improper state validation, a remote attacker could bypass the browser's web origin policy by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to access sensitive information across different web origins that would normally be protected.
Statement
This vulnerability is rated as Important severity because circumventing web origin isolation compromises confidentiality and integrity across distinct web sessions. Upstream reports indicate this condition specifically impacts Chromium builds on Windows platforms via ANGLE state validation routines. On Red Hat Enterprise Linux, browser sandboxing restricts the blast radius to the browser renderer process, and successful exploitation requires a user to actively load a malicious web page.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
