Urgent: Fedora 42 Chromium Update Patches 29 Security Flaws—Including Critical CVE-2026-3913

 

More than 20 critical Chromium vulnerabilities, including CVE-2026-3913, now target Fedora 42 systems. This comprehensive guide details the 29 security patches in version 146.0.7680.71, explains the technical impact of WebML heap buffer overflows, and provides step-by-step DNF commands to secure your installation against remote code execution threats.

The open-source ecosystem thrives on transparency, but that transparency can sometimes expose critical attack vectors. Today, Fedora 42 users face a stark reminder of this reality: a severe security update for the Chromium browser has been released, patching a total of 29 distinct vulnerabilities that could leave your system exposed to remote code execution .

The Fedora Project has officially released chromium-146.0.7680.71-1.fc42, addressing a swath of memory corruption flaws, the most critical of which—CVE-2026-3913—is a heap buffer overflow in the WebML component . 

If you are running a Chromium-based browser on Fedora 42, your system is at risk. Here is exactly what these vulnerabilities mean, why they command a CVSS score as high as 9.8, and the precise commands you need to run to secure your machine immediately .

The Anatomy of the Attack: Why CVE-2026-3913 is "Critical"

To understand the gravity of this update, we must look under the hood at the architecture of modern browsers. Chromium, the open-source project powering Google Chrome, Microsoft Edge, and Vivaldi, relies on components like WebML (Web Machine Learning) to handle complex computational tasks . This is where the danger lies.

Heap Buffer Overflow in WebML (CVE-2026-3913)

The headline vulnerability, CVE-2026-3913, is classified as Critical by the Chromium team . Discovered by researcher Tobias Wienand—who earned a $33,000 bug bounty for his efforts—this flaw allows a remote attacker to exploit heap corruption via a crafted HTML page .

• Technical Impact: When a user visits a malicious website, the browser attempts to write data to a memory location. Due to the heap buffer overflow, it writes beyond the allocated buffer, overwriting adjacent memory.

• Real-World Consequence: This corruption can be leveraged to inject and execute arbitrary code on the host machine, effectively bypassing user permissions .

The Supporting Cast: 28 Additional Threats

While CVE-2026-3913 takes the spotlight, it is far from alone. The update addresses a cascade of high-severity issues that demonstrate a focused attack on memory management :

• Integer Overflow (CVE-2026-3914) & Additional Heap Overflow (CVE-2026-3915): Also located in WebML, these flaws could lead to similar heap corruption scenarios and earned researchers a combined $86,000 .

• "Use After Free" (UAF) Exploits: Multiple vulnerabilities (CVE-2026-3917 to CVE-2026-3924) involve "use after free" conditions in critical components like Extensions, MediaStream, and WebMIDI . UAF occurs when a program continues to use a pointer after the memory it points to has been freed, leading to program crashes or arbitrary code execution.

• Out of Bounds Reads: Found in Web Speech (CVE-2026-3916) and V8 (CVE-2026-3926), these vulnerabilities could allow a sandbox escape, breaking the browser's primary defense mechanism .

"The concentration of vulnerabilities in WebML and V8 suggests that attackers are increasingly targeting the APIs that handle AI and JavaScript processing," explains a recent analysis from Tenable. "These components are complex and relatively new, making them prime real estate for memory corruption discoveries" .

Comprehensive Vulnerability Breakdown

To assist system administrators in assessing their risk, here is a categorized list of the most significant CVEs included in this Fedora 42 update :

Critical & High Severity Memory Flaws

• CVE-2026-3913: Heap buffer overflow in WebML

• CVE-2026-3914: Integer overflow in WebML

• CVE-2026-3915: Heap buffer overflow in WebML

• CVE-2026-3916: Out of bounds read in Web Speech (Potential sandbox escape)

• CVE-2026-3917: Use after free in Agents

• CVE-2026-3918: Use after free in WebMCP

• CVE-2026-3919: Use after free in Extensions

• CVE-2026-3920: Out of bounds memory access in WebML

• CVE-2026-3921: Use after free in TextEncoding

• CVE-2026-3922: Use after free in MediaStream

• CVE-2026-3923: Use after free in WebMIDI

• CVE-2026-3924: Use after free in WindowDialog

• CVE-2026-3926: Out of bounds read in V8

• CVE-2026-3931: Heap buffer overflow in Skia (Graphics engine)

Policy & UI Bypass Vulnerabilities

• CVE-2026-3925: Incorrect security UI in LookalikeChecks (Phishing filter bypass)

• CVE-2026-3927: Incorrect security UI in PictureInPicture

• CVE-2026-3928: Insufficient policy enforcement in Extensions

• CVE-2026-3930: Unsafe navigation in Navigation

• CVE-2026-3932: Insufficient policy enforcement in PDF

• CVE-2026-3935: Incorrect security UI in WebAppInstalls

Information Disclosure

• CVE-2026-3929: Side-channel information leakage in ResourceTiming

Immediate Remediation: The DNF Upgrade Path

For system administrators and power users, patching these vulnerabilities is not a suggestion—it is a mandate for maintaining system integrity. Fedora's package manager, DNF, provides the tools necessary to apply this update immediately .

Step-by-Step Update Instructions

Follow these commands in your terminal to harden your system against CVE-2026-3913 and related threats:

1. Refresh Repository Cache:

   Before upgrading, ensure your system has the latest package metadata.
   bash

   sudo dnf upgrade --refresh

2. Apply the Chromium Update:

   Execute the specific update command referencing the advisory FEDORA-2026-e71e71d1fe .
   bash

   sudo dnf upgrade --advisory FEDORA-2026-e71e71d1fe

   Alternatively, you can update all packages:

   bash

   sudo dnf update chromium

3. Verification:

   After the update completes, verify the installation to ensure you are running the patched version.
   bash

   chromium --version

   The output must read: Chromium 146.0.7680.71 or higher .

4. Restart the Browser:

   A simple restart is insufficient; ensure no Chromium processes are lingering in the background. For a thorough reset, log out of your desktop session or reboot the system.

Frequently Asked Questions

Q:What is a heap buffer overflow?

A:  heap buffer overflow occurs when software writes data beyond the allocated memory buffer in the heap (the memory region used for dynamic allocation). This corrupts data, crashes the program, or allows attackers to insert malicious code .

Q: Is my Fedora 42 system automatically updated?

A: While Fedora supports automatic updates, they are not always enabled by default for all repositories. It is best practice to manually check for critical security updates like this one using the dnf commands provided above.

Are other browsers affected?

A: Yes. Since Chromium is the foundation for Google Chrome, Microsoft Edge, Brave, and Vivaldi, these vulnerabilities likely affect those browsers on Fedora as well until they release their own synchronized updates .

Q: Could this exploit happen without my interaction?

A: Most of these vulnerabilities, particularly CVE-2026-3913, require user interaction—specifically, visiting a malicious website. However, drive-by downloads and compromised legitimate sites make this interaction frighteningly easy for attackers to facilitate .

Conclusion: The New Reality of Browser Security

The release of Chromium 146.0.7680.71 for Fedora 42 underscores a critical trend in cybersecurity: the browser is the new operating system, and memory safety is the new battleground. 

With 29 vulnerabilities patched in a single cycle—and with bug bounties exceeding $150,000—it is clear that threat actors are dedicating significant resources to finding flaws in how browsers handle memory .

Ignoring this update is not merely an operational oversight; it is a security liability. By taking five minutes to run the dnf commands outlined above, you are not just updating a browser—you are reinforcing the perimeter of your digital life against remote code execution, data theft, and system compromise.

Next Steps:

1. Immediate Action: Run the update commands now.

2. Habit Formation: Enable weekly dnf update checks.

3. Knowledge Sharing: Forward this guide to your IT team or colleagues using Fedora 42.

Stay secure, stay updated.