CVE-2026-17861
Description
An insufficient validation of untrusted input flaw was found in the Updater component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=520417861
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
Arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient. This is especially true for web-server extensions such as .asp and .php because these file types are often treated as automatically executable, even when file system permissions do not specify execution. For example, in Unix environments, programs typically cannot run unless the execute bit is set, but PHP programs may be executed by the web server without directly invoking them on the operating system.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
