DEBIAN-CVE-2026-120930: Debian/chromium vulnerability

Q: Who is exposed to this issue?

Users of Debian's chromium package are exposed when using a version of Google Chrome/Blink prior to 156.0.8078.47. Exploitation requires the user to load an attacker-crafted HTML page remotely.

Q: What could an attacker do?

A remote attacker could bypass the web origin policy through a crafted HTML page. The issue is classified as High severity by Chromium.

Published Nov 3, 2026

Updated

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Affected Software

3 affected componentsFixes available

debian/chromium<156.0.8078.47-1~deb12u1

156.0.8078.47-1~deb12u1

debian/chromium<156.0.8078.47-1~deb13u1

156.0.8078.47-1~deb13u1

debian/chromium<156.0.8078.47-1

156.0.8078.47-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1~deb12u1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1~deb13u1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1

Event History

Nov 3, 2026

CVE Published

via OSV·10:19 PM

Data Sourced

via OSV·10:19 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Debian's chromium package are exposed when using a version of Google Chrome/Blink prior to 156.0.8078.47. Exploitation requires the user to load an attacker-crafted HTML page remotely.

What could an attacker do?

A remote attacker could bypass the web origin policy through a crafted HTML page. The issue is classified as High severity by Chromium.

DEBIAN-CVE-2026-120930: Debian/chromium vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What could an attacker do?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What could an attacker do?