CVE-2026-126914
Description
A flaw was found in chromium-browser. An uninitialized resource vulnerability in the Skia graphics library allows a remote attacker to cause information disclosure. By convincing a user to visit a specially crafted HTML page, an attacker can access sensitive cross-origin data, exposing information from other websites.
Statement
This vulnerability is rated as Moderate rather than Important because exploitation is constrained to cross-origin information disclosure and requires a user to actively navigate to a malicious web page, preventing arbitrary code execution. Within Red Hat Enterprise Linux desktop environments, Chromium operates with process sandboxing enabled by default, restricting unauthorized memory inspection to the rendering process. Consequently, the flaw cannot be leveraged to compromise host system files or gain elevated privileges on the underlying operating system.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
