DEBIAN-CVE-2026-119271: Use After Free

Published Oct 30, 2026

Updated

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

4 affected components

debian/chromium*

debian/libskia*

Event History

Oct 30, 2026

CVE Published

via OSV·01:16 AM

Data Sourced

via OSV·01:16 AM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause a user to load a crafted HTML page in an affected Chromium or Skia environment. Successful exploitation can execute arbitrary code inside the browser sandbox.

Which Debian software packages are identified as affected?

The affected software listed is debian/chromium and debian/libskia.

Is this vulnerability exploitable remotely?

Yes. The issue is described as allowing a remote attacker to exploit it through a crafted HTML page, without indicating that local access is required.

DEBIAN-CVE-2026-119271: Use After Free

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Debian software packages are identified as affected?

Is this vulnerability exploitable remotely?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Debian software packages are identified as affected?

Is this vulnerability exploitable remotely?