Critical [CVE-2026-93373] Arbitrary code execution outside the sandbox via crafted extension
This critical-severity Red Hat Linux advisory covers CVE-2026-93373.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) This vulnerability is caused by a use-after-free condition, where the application attempts to access system memory after it has already been released.
A remote attacker could exploit this flaw by enticing a user to install or run a specially crafted browser extension. Successful exploitation allows the attacker to bypass browser security boundaries (sandbox) and execute arbitrary code on the target system.
In Red Hat Enterprise Linux environments, chromium-browser is primarily deployed on graphical workstation systems. Exploitation requires user interaction to load or run an untrusted extension.
Server installations lacking graphical environments or browser packages do not expose this attack surface. Red Hat severity: Important — CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Weakness: CWE-825.
- < 153.0.8010.52
Official advisory · high-confidence parse· fetched 5 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 5 hours ago·verify at source
Mitigation checklist
- Do not install or run browser extensions from untrusted sources. If the browser is not required for operations, remove the package to eliminate the attack surface: # dnf remove chromium-browser Caveats: Removing this package removes the Chromium browser from the system and may disrupt graphical workstation workflows or applications relying on the browser. Headless server systems remain fully operational via the command line.
Official advisory · high-confidence parse· fetched 5 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.