CVE-2026-118319

A memory corruption flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://issues.chromium.org/issues/576194994

Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to isolate browser renderer processes and prevent execution of untrusted graphics rendering workloads through unpatched Skia libraries: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia component to eliminate out-of-bounds memory access inside the browser sandbox, closing crafted HTML page. Until patched, this is a concern on Chromium and Webkitgtk browser environments processing untrusted web content, so restrict user access to untrusted web content and enforce strict network filtering against external, untrusted web destinations. As a compensating measure, Enable ASLR to randomize renderer process memory layout and hinder reliable pointer calculations, Enforce non-executable page permissions (NX/XD bit) to block shellcode execution in data memory, Enforce full RELRO and PIE in browser binaries to prevent Global Offset Table overwrite, Enable Control Flow Integrity and Shadow Call Stack to validate indirect call targets and return addresses, Enable Arbitrary Code Guard on Windows to block dynamic allocation of executable memory pages, and Deploy EDR agents to monitor and detect anomalous post-exploitation behaviors or shell spawning from browser renderers. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)