CVE-2026-76042
Description
A flaw was found in Google Chrome, specifically within its GPU component, where an uninitialized resource could be used. A remote attacker, after compromising the renderer process, could exploit this by crafting a malicious HTML page. This could allow the attacker to read memory outside of the browser's security sandbox, leading to information disclosure.
Statement
This Moderate impact information disclosure flaw in Chromium and QtWebEngine, affecting community projects, requires a prior renderer process compromise and user interaction with a specially crafted HTML page. The need for these preconditions reduces the overall risk in typical Red Hat desktop deployments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the uninitialized pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the uninitialized pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the uninitialized pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
