CVE-2026-126922
Description
A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Skia graphics component allows a remote attacker who has already compromised the browser's renderer process to access sensitive memory. By tricking a user into viewing a crafted HTML page, the attacker can leak cross-origin data, compromising confidential information from other websites.
Statement
This vulnerability is assessed as having a Moderate severity rather than Important because exploitation requires a pre-existing compromise of the browser's sandboxed renderer process. On Red Hat Enterprise Linux systems where chromium-browser is deployed, default multi-process sandboxing restricts the blast radius of renderer compromises from accessing the underlying operating system. Consequently, an attacker who induces a user to process malicious web content can only leak cross-origin memory within the browser session, without achieving arbitrary host code execution or elevated system privileges.
Mitigation
Avoid opening untrusted web pages or untrusted HTML documents in the browser. Ensure that chromium-browser is executed with its built-in sandbox and site isolation active, avoiding command-line options such as `--no-sandbox` or `--disable-site-isolation-trials`.
If chromium-browser is not strictly needed on the system, remove the package to eliminate the attack surface:
# dnf remove chromium-browser
Caveats: Restricting browser usage to trusted sites relies on operational discipline and may not be feasible in standard web workflows. Removing the package eliminates web browsing capabilities and may affect desktop applications or helper scripts that depend on chromium-browser.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
