CVE-2026-118340

A memory corruption flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://issues.chromium.org/issues/568936530

Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce Control Flow Integrity and Shadow Call Stack to validate indirect call targets and block control-flow hijacking from memory corruption in Skia: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia 2D graphics rendering engine, closing crafted HTML page. Until patched, this is a concern on users navigating to attacker-controlled or malicious websites on any platform using affected browsers, so restrict user navigation to trusted websites and prevent opening untrusted HTML pages or untrusted links in affected browser environments. As a compensating measure, randomize userspace process memory layouts via ASLR to impede deterministic code execution and ROP gadget chaining, enforce non-executable memory via NX/XD bit to block code execution from writable heap and stack pages, enable full RELRO and PIE to protect Global Offset Tables from overwrites and support complete address randomization, compile binaries with FORTIFY_SOURCE to terminate processes upon detecting runtime buffer overflows in standard library calls, apply kernel-level seccomp syscall filtering to restrict system calls and prevent sandbox escapes, and deploy endpoint detection and response monitoring to detect anomalous process spawning and post-exploitation execution. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-113 Control Flow Integrity (CFI / Shadow Call Stack) (high)