CVE-2026-78906

A flaw was found in Chromium's ANGLE component. A race condition, triggered by a specially crafted HTML page, could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This could lead to a complete compromise of the affected system.

Red Hat Product Security rates the severity of this vulnerability as Important rather than Moderate because successful exploitation can break out of the browser sandbox to execute arbitrary commands with the privileges of the local user. In Red Hat Enterprise Linux environments, the affected graphics translation library is predominantly consumed by desktop utilities and web engines such as WebKitGTK, rather than exposed server services. Exploitation requires user interaction to open or render an untrusted, maliciously crafted web document, and successful code execution relies on winning a timing window in multi-threaded rendering operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.