Fedora 43 Chromium 155.0.8059.84 Update Patches CVE-2026-110913/110914/110915/110916 — Detection and Remediation Guide

Fedora 43 has shipped an urgent Chromium update to version 155.0.8059.84, carrying ten security fixes — four of which are tracked with CVE identifiers and all of which sit in the browser's most attack-exposed components: the DOM engine, Web Workers, the Compositing layer, and Desktop integration. The advisory (Fedora FEDORA-2026-5a871d2ca7) covers:

• CVE-2026-110913 — Memory corruption in DOM
• CVE-2026-110914 — Memory corruption in Workers
• CVE-2026-110915 — Use-after-free in Compositing
• CVE-2026-110916 — Improper input validation in Desktop

If your organization runs Fedora workstations — and many engineering, developer, and security teams do — this is a patch-now event. Browser renderer bugs are the single most reliable initial-access primitive an adversary can buy or build, and memory corruption in DOM/Workers is precisely the class of vulnerability that gets chained into full renderer RCE and sandbox escapes in real-world exploit kits. Every unpatched Chromium instance on Fedora 43 is one drive-by page or phishing link away from code execution in the renderer context.

Technical Analysis

Affected Products and Versions

Note that Chromium-based derivatives and Flatpak/Snap builds of Chromium follow separate update channels — verify those independently. dnf list installed chromium will tell you what you're actually running.

Vulnerability Breakdown

CVE-2026-110913 — Memory corruption in DOM. The DOM (Document Object Model) is the parsed, live representation of every web page the browser renders. Memory corruption here is typically triggered by attacker-controlled HTML/JavaScript — no user interaction beyond visiting a page. Historically, DOM corruption primitives (type confusion, heap grooming via DOM node manipulation) are the starting point for renderer RCE chains. An attacker hosting or injecting malicious content (watering hole, malvertising, compromised legitimate site) can reach this code path remotely.

CVE-2026-110914 — Memory corruption in Workers. Web Workers run JavaScript on background threads, off the main UI thread — which means exploitation attempts can operate without the visual artifacts (page hangs, render glitches) that sometimes tip off a user. Worker-based corruption is attractive to exploit developers because Workers are heavily used by legitimate modern web apps, making malicious Worker activity harder to distinguish behaviorally.

CVE-2026-110915 — Use-after-free in Compositing. The compositor is responsible for assembling rendered layers into the final displayed frame, and in Chromium's architecture it straddles the renderer and GPU process boundary. UAF bugs in compositing are particularly dangerous because the GPU process historically has a broader sandbox profile than the renderer — a successful exploit here can be a stepping stone out of the tightest sandbox layer. UAFs are also highly valued because freed-object reclamation gives attackers deterministic control over the corrupted memory contents.

CVE-2026-110916 — Improper input validation in Desktop. Desktop integration covers interactions between the browser and the host OS environment — file handling, protocol handlers, notifications, drag-and-drop. Improper input validation at this boundary can allow malicious web content to influence OS-level operations with insufficient sanitization, a classic vector for escaping purely web-contained impact.

Exploitation Requirements and Attack Chain

From a defender's perspective, the exploitation model for all four CVEs is consistent with modern browser exploitation:

1. Delivery: Victim browses to attacker-controlled or attacker-injected content (phishing link, watering hole, malvertising, compromised CMS).
2. Renderer compromise: Malicious JavaScript/HTML triggers CVE-2026-110913 or -110914, achieving arbitrary read/write or code execution inside the sandboxed renderer process (chromium renderer child processes, --type=renderer).
3. Sandbox escalation: CVE-2026-110915 (compositing UAF) or -110916 (desktop input validation) is chained to escape or weaken the renderer sandbox and interact with the GPU process or host OS desktop services.
4. Post-exploitation: Attacker drops a payload, establishes persistence (systemd user units, ~/.config/autostart, cron), or begins interactive reconnaissance from the compromised workstation.

Exploitation Status

As of this writing, the Fedora advisory does not indicate confirmed in-the-wild exploitation, and none of these four CVEs appear in the CISA Known Exploited Vulnerabilities catalog at publication time. Do not let that lower your urgency: Google and the Chromium project routinely withhold technical detail on renderer bugs until patch adoption is high, precisely because these bug classes convert to working exploits quickly once diffed. Treat the gap between advisory publication and your patch deployment as your exposure window.

Detection & Response

Browser memory corruption bugs don't leave clean IOCs — there are no hashes to block and no static C2 domains to sinkhole. Detection has to be behavioral: watch for the symptoms of renderer compromise and post-exploitation activity on your Linux endpoints.

What to Hunt For

1. Chromium child processes spawning unexpected binaries. A sandboxed renderer that suddenly execs bash, sh, python, curl, or wget is a strong post-exploitation signal. Legitimate Chromium spawning shells is rare outside of specific developer tooling integrations.
2. Renderer crash loops followed by successful execution. Exploit development against heap corruption is unreliable — repeated renderer crashes (--type=renderer processes dying and respawning) can indicate active exploitation attempts, especially clustered per-user.
3. Persistence artifacts appearing shortly after browser sessions. New systemd user units, .config/autostart entries, or cron entries created within minutes of heavy browser activity.
4. Outdated Chromium still in the fleet. Your highest-fidelity detection is a version inventory.

Sigma Rules

---
title: Chromium Renderer Spawning Shell or Script Interpreter
id: 8f3a1b62-4c7d-4e91-a2f5-6d8c9b0e1a23
status: experimental
description: Detects Chromium browser processes spawning shells, script interpreters, or download tools. Consistent with post-exploitation behavior following renderer compromise via memory corruption bugs such as CVE-2026-110913 or CVE-2026-110914.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-chromium-2026-5a871d2ca7
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'chromium'
      - 'chrome'
  selection_child:
    CommandLine|contains:
      - '/bin/bash'
      - '/bin/sh'
      - 'python'
      - 'perl'
      - 'curl '
      - 'wget '
      - 'base64'
  condition: selection_parent and selection_child
falsepositives:
  - Developer workflows using browser-integrated terminals or extensions
  - Enterprise password managers or SSO agents invoked by the browser
level: high
---
title: Chromium Renderer Crash Loop — Possible Exploitation Attempt
id: 2b7e4d19-9a3f-4c58-b6d1-8e0f2a5c7d94
status: experimental
description: Detects rapid respawning of Chromium renderer processes, a pattern consistent with unreliable heap corruption exploitation attempts (e.g., CVE-2026-110913, CVE-2026-110915) where repeated crashes precede a successful exploit.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-chromium-2026-5a871d2ca7
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '--type=renderer'
  condition: selection | count() by User > 15
falsepositives:
  - Users with many open tabs on memory-constrained systems
  - Crashing misbehaving extensions
level: medium
---
title: Persistence Artifact Created by Chromium Process Tree
id: 5c9d1e47-2f8a-4b36-9c04-7a1e3d6b8f52
status: experimental
description: Detects creation of Linux persistence artifacts (systemd user units, autostart entries, cron files) by processes descending from Chromium, consistent with post-exploitation persistence after browser compromise such as CVE-2026-110916 desktop input validation abuse.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-chromium-2026-5a871d2ca7
  - https://attack.mitre.org/techniques/T1543/
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1543.002
  - attack.t1053.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '.config/autostart/'
      - '.config/systemd/user/'
      - '/etc/systemd/system/'
      - '/var/spool/cron/'
      - '/etc/cron.d/'
  selection_creator:
    Image|contains:
      - 'chromium'
      - 'chrome'
  condition: selection_path and selection_creator
falsepositives:
  - Browser extensions that legitimately install desktop integrations
level: high

KQL — Microsoft Sentinel / Defender Hunting

Even for Linux estates, most mature SOCs ingest Fedora endpoint telemetry into Sentinel via Syslog/CEF forwarders or run Defender for Endpoint on Linux. The first query hunts post-exploitation child processes from Chromium; the second is your fleet compliance check.

// Hunt 1: Chromium spawning shells, interpreters, or download tools on Linux endpoints
// Requires Syslog or Defender for Endpoint (Linux) ingestion
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("chromium", "chrome")
| where FileName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2 (Syslog-based alternative for environments without MDE on Linux)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "chromium"
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "python", "curl", "wget")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Fleet version compliance — find Chromium installs older than 155.0.8059.84
// Run via your config management or captured 'chromium --version' telemetry in a custom table
let FixedVersion = "155.0.8059.84";
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ApplicationProtocol has "chromium-version"   // adjust to your telemetry source
| extend InstalledVersion = tostring(split(AdditionalExtensions, "=")[-1])
| where InstalledVersion != FixedVersion
| summarize arg_max(TimeGenerated, *) by Computer, InstalledVersion
| project Computer, InstalledVersion, TimeGenerated;

Velociraptor VQL

For DFIR teams validating whether a specific Fedora workstation was compromised before patching, this artifact enumerates running Chromium process trees and flags suspicious children, then inventories persistence locations modified recently:

-- Artifact: Linux.Hunt.ChromiumPostExploitation
-- Hunts for suspicious child processes under Chromium and recent persistence artifacts
-- relevant to renderer compromise (CVE-2026-110913 / -110914 / -110915 / -110916)

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'chromium|chrome'
   OR Name =~ '^(bash|sh|dash|zsh|python|python3|perl|curl|wget|nc|ncat)$'

LET persistence_artifacts = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  '/home/*/.config/autostart/*.desktop',
  '/home/*/.config/systemd/user/*.service',
  '/etc/systemd/system/*.service',
  '/etc/cron.d/*',
  '/var/spool/cron/*'
])
WHERE Mtime > (now() - 604800)   -- modified in last 7 days

SELECT * FROM suspicious_children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'PERSISTENCE_ARTIFACT' AS Name,
       FullPath AS CommandLine, NULL AS Exe, NULL AS Username, Mtime AS CreateTime
FROM persistence_artifacts

Run this as a hunt across your Linux fleet after patch deployment. Correlate any suspicious child process PIDs against the parent Chromium process start time — if the child spawned during a browsing session on an unpatched build, escalate to full IR triage (memory capture, browser cache forensics, network flow review).

Remediation and Verification Script

The following Bash script updates Chromium on Fedora 43, verifies the installed version meets the fixed build, restarts running instances, and flags stale processes still running the vulnerable binary:

#!/usr/bin/env bash
# remediation-chromium-fedora43.sh
# Patches Chromium to 155.0.8059.84+ on Fedora 43 and verifies no vulnerable processes remain
# CVEs: CVE-2026-110913, CVE-2026-110914, CVE-2026-110915, CVE-2026-110916

FIXED_VERSION="155.0.8059.84"

set -euo pipefail

echo "[+] Current Chromium package state:"
rpm -q chromium 2>/dev/null || echo "    chromium not installed via rpm"

# --- Check for Flatpak/Snap installs (separate update channels) ---
if command -v flatpak &>/dev/null; then
  flatpak list --app 2>/dev/null | grep -i chromium && \
    echo "[!] Flatpak Chromium detected - update separately: flatpak update org.chromium.Chromium"
fi

# --- Apply the update ---
echo "[+] Applying Fedora update (FEDORA-2026-5a871d2ca7)..."
sudo dnf upgrade -y --refresh --advisory FEDORA-2026-5a871d2ca7 2>/dev/null || \
sudo dnf upgrade -y --refresh chromium

# --- Verify installed version ---
INSTALLED=$(rpm -q --queryformat '%{VERSION}' chromium 2>/dev/null || echo "0")
echo "[+] Installed version: ${INSTALLED} | Fixed version: ${FIXED_VERSION}"

if [[ "$(printf '%s\n%s' "$FIXED_VERSION" "$INSTALLED" | sort -V | head -n1)" == "$FIXED_VERSION" ]]; then
  echo "[OK] Chromium is at or above the fixed build."
else
  echo "[FAIL] Chromium is still below ${FIXED_VERSION}. Check mirror sync or advisory availability." >&2
  exit 1
fi

# --- Identify running instances of the old binary ---
# A running Chromium process does not pick up the new binary until restarted.
STALE=$(pgrep -a -f chromium 2>/dev/null | grep -v "$$" || true)
if [[ -n "$STALE" ]]; then
  echo "[!] Running Chromium processes detected - they are STILL the vulnerable build until restarted:"
  echo "$STALE"
  echo "[+] Terminating to force restart with patched binary (user sessions will reload tabs)..."
  pkill -f 'chromium.*--type=' 2>/dev/null || true
  pkill -f chromium-browser 2>/dev/null || true
  echo "[OK] Chromium processes terminated. Users should relaunch the browser."
else
  echo "[OK] No running Chromium processes."
fi

# --- Audit: report version evidence for compliance logging ---
echo "[+] Audit record:"
echo "    Host: $(hostname)"
echo "    Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "    Package: $(rpm -q chromium)"
echo "    Advisory: FEDORA-2026-5a871d2ca7"

Deploy this via Ansible, Satellite, or your configuration management of choice across the fleet. The critical detail many teams miss: patching the package does not patch the running process. A Chromium instance launched before the update keeps the vulnerable renderer code mapped in memory until every process is restarted. The script handles this; a bare dnf upgrade does not.

Remediation Steps

1. Patch immediately. Apply dnf upgrade --advisory FEDORA-2026-5a871d2ca7 (or dnf upgrade chromium) on all Fedora 43 systems. Target completion within 72 hours for internet-facing users (developers, executives, helpdesk) and within one week fleet-wide. There is no official CISA KEV deadline as of publication — set your own SLA and hold it.
2. Restart all browser processes post-patch. Verify no pre-patch Chromium processes survive. Audit with pgrep -a chromium and confirm process start times post-date the update.
3. Update alternative packages. Flatpak (org.chromium.Chromium), Snap, and any manually installed Chromium builds update on their own cadence — inventory and update them separately. They are frequently forgotten and become your residual exposure.
4. Verify version fleet-wide. Collect chromium --version or rpm -q chromium output centrally. Anything below 155.0.8059.84 is vulnerable to all four CVEs.
5. No workaround exists. There is no configuration toggle that mitigates DOM/Workers/Compositing memory corruption. Site isolation and the sandbox reduce blast radius but do not prevent renderer compromise. Patching is the only remediation.
6. Hunt before you close the ticket. Run the detection content above across the exposure window (advisory date → patch date) per host. Memory corruption bugs this clean rarely sit unexploited for long once public.
7. Reduce future exposure. Consider enforcing automatic DNF updates for the browser package specifically, deploying DNS filtering to cut malvertising/watering-hole delivery, and restricting browser usage on high-value admin workstations (use a dedicated jump host or remote browser isolation for administrative portals).

Final Assessment

Four memory-corruption and input-validation CVEs in the most attack-surface-rich components of the browser, fixed in a single emergency cadence update — this is exactly the profile of an advisory that should not wait for your next maintenance window. The bugs (CVE-2026-110913, -110914, -110915, -110916) are remote, require only that a user render malicious content, and live in code paths that real exploit chains have used for years. Patch within 72 hours, restart the browsers, hunt the exposure window, and verify versions fleet-wide. The advisory is FEDORA-2026-5a871d2ca7.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub