DEBIAN-CVE-2026-121035: Use After Free
Published Nov 3, 2026
·Updated
Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require an attacker to have an account or local access?
No. The CVSS vector indicates network-based exploitation with no privileges required, but it does require user interaction.
2
How can I assess whether my Chromium installation is in the affected range?
The issue is described as affecting Google Chrome versions before 157.0.8103.38. For Debian Chromium, verify the installed package version against Debian security-tracker guidance, since no Debian-specific fixed package version is provided here.