CVE-2026-91402
Description
A flaw was found in OpenJFX. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to run untrusted code in a sandboxed client environment. Successful exploitation allows the attacker to obtain unauthorized read access to sensitive data, leading to information disclosure.
Statement
This vulnerability is rated Low severity because successful exploitation requires complex attack conditions alongside user interaction, resulting only in limited, unauthorized data exposure. Red Hat Enterprise Linux and enterprise Java platforms predominantly operate in headless server, container, and build environments where only administrator-approved, trusted code is executed. The flaw primarily poses a threat to client-side configurations executing untrusted mobile code within legacy sandbox architectures, which are not supported or deployed by default in standard Red Hat operating environments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles, extending the scope of the damage to higher-privileged users..
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
