CVE-2026-79275
Description
A flaw was found in ANGLE, a component of Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. The attacker could exploit this by enticing a user to visit a specially crafted HTML page.
Statement
This vulnerability is rated as Critical severity for Red Hat products because an unauthenticated remote attacker can escape the application sandbox to execute arbitrary code on the underlying host. On standard Red Hat Enterprise Linux server installations, graphical rendering libraries such as WebKitGTK and Chromium are not installed or invoked by default unless workstation packages or desktop environments are explicitly selected. Triggering the flaw requires a local user to process a malicious, attacker-controlled web page in a vulnerable web rendering application. However, the ability to break isolation boundaries and achieve full host code execution justifies the Critical rating for environments where these desktop components are active.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.6 | N/A | 9.6 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
