Bug 2559564

Summary: CVE-2026-112993 CVE-2026-113011 CVE-2026-113019 CVE-2026-113033 CVE-2026-113035 CVE-2026-113044 CVE-2026-113055 CVE-2026-113058 CVE-2026-113068 CVE-2026-113070 CVE-2026-113079 CVE-2026-113092 CVE-2026-113095 ... chromium: various flaws [fedora-all]
Product: [Fedora] Fedora Reporter: Dhananjay Arunesh <darunesh>
Component: chromiumAssignee: Than Ngo <than>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: go-sig, pigpigman8686, spotrh, suraj.ghimire7, than, yaneti
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["704ccd42-1101-4b92-b9ef-f7b0917fc605", "7fdca7cd-613f-4e78-90eb-a2364584ba14", "21dbc4ed-8c90-4113-8de3-cd790eba5a4e", "359aff1c-e590-4943-91ac-b65d20cb5343", "0115f485-c42d-4104-a7fd-9c83dbc4ce23", "f3dba0dd-66a0-445a-89a3-d4f9f67450e1", "01287372-842d-404a-8cc0-1263d3e8b375", "882b7866-1cd1-4017-b134-80a614ab0a21", "e3c8e807-579e-43e9-a632-5c7fcb029d88", "8f8920bd-1a5a-4d8b-9c95-b1297719bcf7", "523dd7ac-b576-43e7-8573-0b5ef148b959", "fc31f148-0277-4909-ac56-66c64f8b481e", "e02a5efc-7f81-4ad8-bd20-ce10bb398650", "a0fb5552-aca0-4bc6-8262-0880c72130d3", "9838a2b8-20e4-4f0c-ad52-7877eb1480d8", "0066b6be-6b99-408a-9271-deb4ec73568a", "2ec3652b-d5b5-46c9-b943-f1ab836baab0", "98090cf2-e8fc-4ef8-a160-6956139d881f", "457e84c2-2f77-41ad-a7d1-a71383517ae5", "fe5ea3bd-ccc9-4541-b6a0-e224a2d50cec", "4b014aed-052b-4f3c-94f7-612e24bbeaf2", "c94f1b9d-0285-44c4-a6b6-b15acfcc43b0", "e15640a6-9092-4e1b-8b21-7a1c97ee5894", "62f0323b-5743-4774-b11b-3ebad0ce5c28", "83579ee4-2b2a-429a-93f3-ba4749cafa83", "6db099eb-22a1-4c73-aa81-bb0174cd170c", "544a9e08-6d3d-412b-b947-37dba560e789", "080220d3-afe7-4683-a796-bc024dd5cce3", "d60f2983-6d1e-4ac7-88d7-cd26bfdddbf9", "e113e39f-41a3-4c44-9b63-b0bff22edfa0", "0a2bde8c-a609-4c3d-9a59-c5bafb6f02e7", "a9c01067-4640-4d8a-878d-ceec0fc4cebb", "46afc096-8eb5-4885-8cb9-227f860a9bb9", "d20f75a9-227c-44bb-b60b-b874d994f484", "f1482b4d-7367-4d5f-9e9d-c5d87703b533", "54d29a38-5e2d-4dc2-85ef-9862f1d4bd44", "ea52d477-aed9-4d61-abbb-51771f45e0c9"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-26 11:37:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2556492, 2556530, 2556539, 2556551, 2556552, 2556561, 2556562, 2556592, 2556615, 2556642, 2556644, 2556651, 2556653, 2556670, 2556686, 2556692, 2556714, 2556718, 2556755, 2556771, 2556779, 2556781, 2556788, 2556792, 2556821, 2556854, 2556862, 2556872, 2556877, 2556919, 2556925, 2556944, 2556948, 2556969, 2556988, 2556990, 2557000    

Description Dhananjay Arunesh 2026-10-23 12:00:33 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Comment 1 Than Ngo 2026-10-26 11:37:17 UTC 
Fixed in 156.0.8078.47