DEBIAN-CVE-2026-121030: Critical severity debian/chromium vulnerability
Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
A remote attacker needs to use a crafted HTML page and rely on social engineering. No attacker privileges are required, but user interaction is required.
What is the potential impact if exploitation succeeds?
Successful exploitation could allow arbitrary code execution outside the browser sandbox. The listed CVSS vector indicates high potential impact to confidentiality, integrity, and availability.
Why do the severity ratings differ?
The entry lists a critical CVSS score of 9.6, while Chromium rates the issue as Medium. Both ratings are provided in the available vulnerability data; no rationale for the difference is included.