CVE-2026-93373
Description
A flaw was found in the Extensions component of Chromium. This vulnerability is caused by a use-after-free condition, where the application attempts to access system memory after it has already been released. A remote attacker could exploit this flaw by enticing a user to install or run a specially crafted browser extension. Successful exploitation allows the attacker to bypass browser security boundaries (sandbox) and execute arbitrary code on the target system.
Statement
This vulnerability is rated as Critical severity for Red Hat because successful exploitation can allow an adversary to bypass browser sandbox restrictions and execute arbitrary code with the privileges of the desktop user. In Red Hat Enterprise Linux environments, chromium-browser is primarily deployed on graphical workstation systems. Exploitation requires user interaction to load or run an untrusted extension. Server installations lacking graphical environments or browser packages do not expose this attack surface.
Mitigation
Do not install or run browser extensions from untrusted sources. If the browser is not required for operations, remove the package to eliminate the attack surface:
# dnf remove chromium-browser
Caveats: Removing this package removes the Chromium browser from the system and may disrupt graphical workstation workflows or applications relying on the browser. Headless server systems remain fully operational via the command line.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
