CVE-2026-78989

A flaw was found in ANGLE, a component of Google Chrome on Windows. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox.

Red Hat rates this flaw as Critical due to the severe blast radius of an unauthenticated remote code execution that escapes process isolation boundaries. While Red Hat Enterprise Linux does not distribute Google Chrome, the underlying ANGLE engine is embedded within WebKitGTK components utilized by graphical applications. Because the defect targets the Windows-specific rendering backend, standard Red Hat enterprise environments running Linux graphics subsystems are not exposed under normal operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.