CVE-2026-78905

A flaw was found in ANGLE, a component used in Google Chrome. This type confusion vulnerability allows a remote attacker to potentially execute arbitrary code outside of the browser's security sandbox. Exploitation can occur by enticing a user to visit a specially crafted HTML page, leading to a compromise of the affected system.

Red Hat rates this vulnerability as Critical impact because an unauthenticated remote attacker can escape containerized renderer isolation boundaries and execute arbitrary code on the host system. In typical Red Hat Enterprise Linux deployments, the affected graphics engine is embedded in WebKit-dependent graphical applications and desktop environments, leaving headless server installations largely unexposed. While exploitation requires user interaction to process a maliciously crafted web document, the resulting sandbox escape presents severe risk to client systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.