CVE-2026-102331

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE (Almost Native Graphics Engine) component. An attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page.

This vulnerability is rated as Important rather than Critical because impact is constrained to the application utilizing the rendering library. In Red Hat Enterprise Linux, this flaw primarily affects WebKitGTK due to its embedded ANGLE graphics translation component, whereas standalone web browsers such as Firefox are not affected. Triggering the underlying memory corruption requires enticing a user into rendering a maliciously crafted webpage, preventing unauthenticated automated exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening untrusted web content or navigating to unverified web pages within applications relying on WebKitGTK or Chromium.

Where feasible, execute web-rendering applications inside restricted containers or sandboxes with minimal user privileges to constrain the impact of potential code execution.

If web rendering is not required on server installations, remove optional packages providing WebKitGTK (such as webkit2gtk3 or webkitgtk4).

Caveat: Removing WebKitGTK packages may remove dependent graphical components, including parts of desktop environments like GNOME. Headless server operations and terminal access will remain unaffected.