DEBIAN-CVE-2026-120931: Debian/chromium vulnerability

Q: Who is exposed to this issue?

Users of Chromium on Android are exposed when they visit a crafted HTML page that triggers the vulnerable WebGL behavior. The issue can lead to arbitrary code execution outside the browser sandbox.

Q: What does an attacker need to exploit it?

The attacker needs to induce the target to load a crafted HTML page. The provided information does not indicate that local access, authentication, or user interaction beyond visiting the page is required.

Q: What version should be remediated?

Google Chrome on Android versions earlier than 156.0.8078.47 are affected according to the advisory. The supplied data identifies the tracked software as Debian Chromium but does not provide a Debian package version or fixed-package version.

Published Nov 3, 2026

Updated

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Affected Software

3 affected componentsFixes available

debian/chromium<156.0.8078.47-1~deb12u1

156.0.8078.47-1~deb12u1

debian/chromium<156.0.8078.47-1~deb13u1

156.0.8078.47-1~deb13u1

debian/chromium<156.0.8078.47-1

156.0.8078.47-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1~deb12u1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1~deb13u1
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 156.0.8078.47-1

Event History

Nov 3, 2026

CVE Published

via OSV·10:19 PM

Data Sourced

via OSV·10:19 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Chromium on Android are exposed when they visit a crafted HTML page that triggers the vulnerable WebGL behavior. The issue can lead to arbitrary code execution outside the browser sandbox.

What does an attacker need to exploit it?

The attacker needs to induce the target to load a crafted HTML page. The provided information does not indicate that local access, authentication, or user interaction beyond visiting the page is required.

What version should be remediated?

Google Chrome on Android versions earlier than 156.0.8078.47 are affected according to the advisory. The supplied data identifies the tracked software as Debian Chromium but does not provide a Debian package version or fixed-package version.

DEBIAN-CVE-2026-120931: Debian/chromium vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What version should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What version should be remediated?