CVE-2026-121249 google chrome: Stack-based Buffer Overflow

Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

--- CME Mitigation Guidance (2026-11-04) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to compile and run Chromium with compiler stack canaries enabled to abort execution before ANGLE stack buffer corruption diverts control flow: upgrade to Google Chrome 157.0.8103.38 (or the fixed Chromium builds), which details are restricted upstream; remediates the out-of-bounds write defect within the ANGLE graphics engine, closing crafted HTML page. Until patched, this is a concern on all platforms running Chromium-based browsers rendering untrusted web content, so restrict user browsing and block access to untrusted or unverified web pages. As a compensating measure, compile with FORTIFY_SOURCE to detect and abort on out-of-bounds writes during standard library memory operations, monitor endpoint detection and response telemetry for anomalous child process spawning and post-exploitation behavior escaping the browser sandbox, enable address space layout randomization across system binaries to impede ROP gadget resolution, and enforce NX/XD bit non-executable memory protection to prevent execution of injected shellcode on the stack. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack-based buffer overflow — apply the upstream patch to fully remediate.

Highest-impact CME: CME-103 Stack Canaries (Stack Protector) (high)