DEBIAN-CVE-2026-118336: Input Validation

Q: What access and interaction does an attacker need to exploit this issue?

The attacker can act remotely and does not need privileges or authentication. Exploitation requires user interaction with a crafted HTML page.

Q: Which Chromium usage is relevant to this vulnerability?

The issue is associated with Headless mode in the Debian chromium package. The provided data does not identify a Debian package version containing a fix.

Published Oct 27, 2026

Updated

Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

3 affected componentsFixes available

debian/chromium*

debian/chromium<156.0.8078.73-1~deb13u1

156.0.8078.73-1~deb13u1

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.73-1~deb13u1

Event History

Oct 27, 2026

CVE Published

via OSV·11:17 PM

Data Sourced

via OSV·11:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access and interaction does an attacker need to exploit this issue?

The attacker can act remotely and does not need privileges or authentication. Exploitation requires user interaction with a crafted HTML page.

Which Chromium usage is relevant to this vulnerability?

The issue is associated with Headless mode in the Debian chromium package. The provided data does not identify a Debian package version containing a fix.

DEBIAN-CVE-2026-118336: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and interaction does an attacker need to exploit this issue?

Which Chromium usage is relevant to this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction does an attacker need to exploit this issue?

Which Chromium usage is relevant to this vulnerability?