CVE-2026-78978

A flaw was found in ANGLE, a component within Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox.

Red Hat rates this vulnerability as Critical because an attacker can remotely escape application confinement and execute unauthorized code under the local user context. Although standard browsers like Firefox and mail clients like Thunderbird remain unaffected, packages leveraging WebKitGTK are vulnerable when processing untrusted web content. Exploitation necessitates user interaction to open a malicious webpage, so default headless server deployments without graphical browsing software face minimal operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.