CVE-2026-126913
Description
A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the compositing component allows a remote attacker who has already compromised the renderer process to access memory outside the restricted security sandbox by convincing a user to visit a specially crafted HTML page. This flaw primarily leads to unauthorized information disclosure, which may assist an attacker in bypassing security boundaries.
Statement
This vulnerability is rated as Important severity because it facilitates a sandbox escape to access memory outside the restricted renderer environment, elevating an initial compromise to higher-privileged information disclosure. In Red Hat Enterprise Linux desktop environments where the Chromium browser is deployed, exploitation requires a user to load malicious web content alongside a prior or chained renderer exploit. Systems running headless or server installations without desktop graphical browser usage are not exposed.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
