CVE-2026-118351

A memory corruption flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://issues.chromium.org/issues/570825067

Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to eliminate memory corruption in Skia graphics rendering routines processing untrusted web content: upgrade to Google Chrome 156.0.8078.73+ (or the corresponding fixed Red Hat builds), which fixes memory corruption in the Skia graphics component when rendering crafted web content, closing crafted HTML page. Until patched, this is a concern on Chromium and WebKitGTK browser users rendering untrusted HTML pages, so restrict user browsing to trusted sites and avoid opening untrusted or attacker-controlled HTML pages. As a compensating measure, enable Full RELRO and PIE to make the Global Offset Table read-only and randomize binary base addresses, enforce kernel-level syscall filtering via seccomp to restrict available system calls in the renderer sandbox, enable Arbitrary Code Guard on Windows to block allocation and execution of dynamic code pages, deploy EDR agents to monitor and detect anomalous child process spawning or payload execution from the browser renderer, and compile with stack canaries to abort execution on stack buffer overflows. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption flaw — apply the upstream patch to fully remediate.

Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (high)