DEBIAN-CVE-2026-118307: Use After Free

Q: What does an attacker need to do to trigger the issue?

The attacker needs to entice a user to interact with a crafted HTML page. The attack can be delivered remotely and does not require attacker privileges.

Q: Is code execution described as occurring outside the browser sandbox?

No. The available information describes potential arbitrary code execution inside the sandbox; it does not state that the vulnerability escapes the sandbox.

Q: What version information is available for remediation?

The issue affects Google Chrome versions prior to 156.0.8078.73. No Debian chromium package version or Debian-specific fixed version is provided.

Published Oct 27, 2026

Updated

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

3 affected componentsFixes available

debian/chromium*

debian/chromium<156.0.8078.73-1~deb13u1

156.0.8078.73-1~deb13u1

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.73-1~deb13u1

Event History

Oct 27, 2026

CVE Published

via OSV·11:16 PM

Data Sourced

via OSV·11:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

The attacker needs to entice a user to interact with a crafted HTML page. The attack can be delivered remotely and does not require attacker privileges.

Is code execution described as occurring outside the browser sandbox?

No. The available information describes potential arbitrary code execution inside the sandbox; it does not state that the vulnerability escapes the sandbox.

What version information is available for remediation?

The issue affects Google Chrome versions prior to 156.0.8078.73. No Debian chromium package version or Debian-specific fixed version is provided.

DEBIAN-CVE-2026-118307: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

Is code execution described as occurring outside the browser sandbox?

What version information is available for remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

Is code execution described as occurring outside the browser sandbox?

What version information is available for remediation?